Supply Chain
How do you sign and verify a Helm chart with provenance?
Helm uses PGP and a .prov file to prove a chart archive is intact and who signed it. Commands, what the file holds, and what it does not prove.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you scan a vendor software update before you deploy it?
Treat a vendor update as an incoming release: verify its source and hash, inspect its contents or SBOM, test in staging, and keep the intake record.
Oct 18, 20263 min read
Supply Chain
How do you roll out a patched Lambda layer version?
Layer versions are immutable, so a fix means publishing a new version and attaching it to every function. A step by step rollout with checks.
Oct 18, 20264 min read
Supply Chain
How do you read a SLSA provenance file, field by field?
A field by field guide to SLSA build provenance: buildType, externalParameters, resolvedDependencies, builder id and runDetails, and which ones to verify.
Oct 18, 20263 min read
Supply Chain
What is go.sum and how do you read it?
go.sum lists a checksum for each module version Go has used, so a changed download is caught. Learn how to read its lines and what to review in a diff.
Oct 18, 20263 min read
Supply Chain
How do you name and store an SBOM for every release?
Name each SBOM by release ID and artifact digest, give it a unique serial number, store it read-only beside the release, and never overwrite an old one.
Oct 18, 20263 min read
Supply Chain
How do you merge SBOMs from several services into one?
Merge per service SBOMs into one product SBOM with a flat or hierarchical merge. See when each fits and what every input file needs before you start.
Oct 18, 20263 min read
Supply Chain
How do you measure SBOM coverage across your suppliers?
Count suppliers with an SBOM, then measure freshness, validity and usable identifiers. Five metrics show if an SBOM program is real or just files.
Oct 18, 20263 min read
Supply Chain
How do you map SBOM components to known vulnerabilities?
A step by step method to turn SBOM components into vulnerability findings: normalize identifiers, query advisories, test version ranges, then enrich.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.