Supply Chain
How do you make a Maven build reproducible, and why bother?
A reproducible Maven build lets anyone rebuild a jar from source and get identical bytes. Set outputTimestamp, test with artifact:compare, and fix leaks.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Why do versions change when I move from Maven to Gradle?
Maven picks the nearest version in the tree and Gradle picks the highest, so the same declarations can resolve differently. How to find and pin the shifts.
Oct 19, 20263 min read
Supply Chain
How do I migrate Maven exclusions to Gradle correctly?
Find out why each Maven exclusion exists, then pick a Gradle exclude, constraint or version override. Copying exclusions blindly can reopen old risks.
Oct 19, 20263 min read
Supply Chain
A bad release is on Maven Central. Can it be removed?
Maven Central does not remove or modify published components. If a release has a bug or a flaw, you need a fixed version and your own pin or exclusion.
Oct 19, 20264 min read
Supply Chain
What is a BOM in Maven, and is it the same as an SBOM?
A Maven BOM is a POM that pins dependency versions. An SBOM is an inventory of what you shipped. They share a name, not a job. Here is how they differ.
Oct 19, 20264 min read
Supply Chain
How do you match an advisory's version range to SBOM versions?
Advisories state affected versions as ranges with introduced and fixed events. Here is how to compare them with SBOM versions without false negatives.
Oct 19, 20264 min read
Supply Chain
How do exception reasons map to OpenVEX justifications?
Map internal exception reasons to the five OpenVEX justifications and see which reasons are risk decisions, not exploitability facts. A reference table.
Oct 19, 20263 min read
Supply Chain
How do you pick supply chain tabletop scenarios? Use SLSA threats
Use the SLSA threat list to choose tabletop scenarios that cover source, dependency, build and registry risks, with one example scenario for each category.
Oct 19, 20264 min read
Supply Chain
How do you map dismissal reasons between two dependency scanners?
Map old dismissal reasons to the new scanner with a translation table, using standard VEX labels as the middle layer so no decision is silently lost.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.