Software Supply Chain
Why did Maven 3.8.1 start blocking HTTP repositories?
Maven 3.8.1 blocks external HTTP repositories by default after CVE-2021-26291. Learn what broke, why, and how to fix your builds without undoing it.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSoftware Supply Chain
What does the xz backdoor teach about attestation?
The xz backdoor hid in release tarballs that differed from git. See how signed provenance makes that mismatch checkable, and what attestation cannot prove.
Oct 18, 20265 min read
Software Supply Chain
What is the Open Container Initiative (OCI) and why does it matter?
The OCI sets open standards for container images, runtimes and registries, so tools interoperate. Learn what that means for supply chain security.
Oct 18, 20264 min read
Software Supply Chain
What is platform as a service (PaaS) and who secures what?
PaaS lets you deploy your own apps on a provider's platform without managing servers. Learn the NIST definition and the security duties that stay with you.
Oct 18, 20264 min read
Software Supply Chain
What is Sigstore Fulcio and how does it issue signing certificates?
Fulcio is Sigstore's code signing certificate authority. It swaps an OIDC identity token for a certificate valid 10 minutes, so no long lived keys.
Oct 18, 20265 min read
Software Supply Chain
What is an SBOM hub and how do you share SBOMs with customers?
An SBOM hub is where authors publish SBOMs and consumers fetch them. CISA names three roles. How to pick a sharing method and control access.
Oct 18, 20264 min read
Software Supply Chain
What is a Trojan horse and how is it different from a virus?
A Trojan horse looks useful but hides malicious code and relies on you running it. See how it differs from viruses and worms and how to defend against it.
Oct 18, 20265 min read
Software Supply Chain
What does autonomous, continuous supply chain security mean?
Continuous means checking on every change, not once a quarter. Autonomous means software takes the routine actions. Here is where to draw the line.
Oct 18, 20264 min read
Software Supply Chain
What does a certificate authority do, and why do browsers trust it?
A certificate authority signs certificates that tie a public key to a domain. Learn how trust chains, ACME, revocation and transparency logs work.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.