Security Guides
SPDX PackageOriginator vs PackageSupplier: who goes in which field?
Supplier is who distributed the package to you, originator is who first created it. See the spec's glibc example and when to use NOASSERTION.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you write an SPDX PackageDownloadLocation for a Git repo?
Use a git+https URL, add an at sign and a refs/tags or commit pin, and a hash sign for a subpath. Or NONE or NOASSERTION when unknown. Examples inside.
Oct 19, 20264 min read
Security Guides
How do you add a purl or CPE to an SPDX package with ExternalRef?
In SPDX 2.3 an ExternalRef line holds category, type and locator. Use PACKAGE-MANAGER for a purl and SECURITY for a CPE. Syntax, examples and mistakes.
Oct 19, 20264 min read
Security Guides
What does the SPDX DESCRIBES relationship do and when is it needed?
DESCRIBES links the SPDX document to the package it covers, and is mandatory when more than one package is present. How to write it and avoid mistakes.
Oct 19, 20264 min read
Security Guides
SPDX DEPENDS_ON, DEPENDENCY_OF or CONTAINS: which relationship fits?
DEPENDS_ON points from consumer to need, DEPENDENCY_OF reverses it, and CONTAINS describes packaging. How to choose, using the spec's definitions.
Oct 19, 20264 min read
Security Guides
How does SPDX record build, dev, test and runtime dependencies?
SPDX has scoped relationships for build, dev, test and runtime dependencies. See when each type fits and why scope changes how you triage findings.
Oct 19, 20263 min read
Security Guides
What are the SPDX Creator, Created and LicenseListVersion fields?
Creator says who or what made the SPDX file, Created is a UTC timestamp, and LicenseListVersion records which license list was used. How to fill each one.
Oct 19, 20264 min read
Security Guides
Is it safe to put credentials in a spark-submit repository URL?
Spark's docs allow credentials inside a repositories URI and warn to be careful. Why that leaks through shells and logs, and what to use instead.
Oct 19, 20264 min read
Security Guides
Spark RPC encryption: SSL or AES, and which settings?
Spark offers SSL and a legacy AES option for RPC encryption. Per its docs SSL is preferred, and AES needs version 2 with GCM to be authenticated.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.