Software Supply Chain
Sigstore vs GPG signing: which fits your releases?
GPG signs with a long lived key you manage. Sigstore signs with short lived certificates tied to an identity and logs the event. Pick by who verifies.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSoftware Supply Chain
How do RubyGems lockfiles and version pinning work?
Gemfile.lock pins every gem, direct or transitive, with SHA-256 checksums. Learn what to commit, how deploys use it and how a cooldown delays new releases.
Oct 18, 20265 min read
Software Supply Chain
How do NuGet lock files and version pinning work?
Turn on RestorePackagesWithLockFile, restore in locked mode in CI, and pin the SDK so a NuGet build resolves the same package graph every time.
Oct 18, 20264 min read
Software Supply Chain
How do you start a software supply chain security program in logistics?
Start a logistics software supply chain program in 90 days: inventory critical systems, tier vendors, collect SBOMs from the top tier, set response rules.
Oct 18, 20265 min read
Software Supply Chain
How do you manage JavaScript dependencies securely with npm?
A practical npm workflow: commit the lockfile, install with npm ci, audit with a failure threshold, verify signatures, and control install scripts in CI.
Oct 18, 20264 min read
Software Supply Chain
How does a healthtech team start a supply chain security program?
A 90 day plan for healthtech teams: inventory components, tie it to HIPAA safeguards, add secure development steps, and prepare SBOM and breach duties.
Oct 18, 20265 min read
Software Supply Chain
How do you run a private Go module proxy that acts as a gatekeeper?
A private Go proxy is a simple HTTP server. Point GOPROXY at it, set GONOSUMDB for private paths, and return 403 for modules you have not approved.
Oct 18, 20265 min read
Software Supply Chain
How do you generate an SBOM for a Rust project?
Commit Cargo.lock, run cargo cyclonedx for a CycloneDX file, embed dependency data with cargo auditable, and run both only on code you trust.
Oct 18, 20265 min read
Software Supply Chain
How do you run a private mirror or proxy for crates.io?
Cargo can swap crates.io for a mirror or vendored copy through source replacement. Learn the config, the rules and what a mirror does and does not protect.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.