DevSecOps
Software Attestation in Practice: From Theory to Implementation
Software attestation is moving from academic concept to practical requirement. Here's how to implement it in your build pipelines today.
Apr 8, 20236 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Software attestation is moving from academic concept to practical requirement. Here's how to implement it in your build pipelines today.
The 3CX supply chain attack exposed critical gaps in how software vendors protect their build pipelines. Here are the concrete lessons.
Maven's dependency resolution mechanism can be exploited through repository poisoning, dependency confusion, and POM manipulation. Here is what Java teams need to know.
Remote development teams depend on VPNs, but misconfigured VPNs create supply chain risks. Split tunneling, credential management, and endpoint security all affect build pipeline integrity.
Makefiles execute shell commands by design. When those commands incorporate untrusted input, the results are predictably dangerous.
CI/CD pipelines trust environment variables implicitly. Injecting or modifying them can hijack builds, steal secrets, and compromise deployments.
Software-Defined Perimeters can isolate build systems, artifact repositories, and deployment pipelines from unauthorized access. Here is how SDP applies to supply chain security.
Build systems create and process temporary files constantly. Race conditions in temp file handling can be exploited to inject malicious content into builds.
Weekly insights on software supply chain security, delivered to your inbox.