Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- AppSec
What are software vulnerabilities and CVEs, and why do they matter?
Learn what makes a software vulnerability, how the CVE Program, CVSS, and CWE score them, and why unpatched CVEs put your data and compliance at risk.
- DevSecOpsSoftware Supply Chain
SBOMs vs. attestations: What's the difference?
An SBOM lists what's in your software, and an attestation proves who built it and how. Learn the difference and when to use cosign attest vs. cosign attach.
- ComplianceSoftware Supply Chain
What is SLSA (Supply-chain Levels for Software Artifacts)?
Learn what the SLSA framework is, how its build track levels (L1 to L3) protect artifacts from tampering, and which tools and practices help you get there.
- ComplianceSoftware Supply Chain
NIST Secure Software Development Framework (SSDF): SP 800-218
Browse every NIST SSDF (SP 800-218) practice in one article, with tasks, implementation examples, and references across prepare, protect, produce, and respond.
- Software Supply Chain
What is apko? Overview and FAQ
apko builds minimal, reproducible OCI images from apk packages declared in YAML. Learn how it works, how it creates SBOMs, and how it pairs with melange.
- Software Supply Chain
What is Rekor? An introduction to the Sigstore transparency log
Rekor is Sigstore's tamper-evident transparency log for signing metadata. Learn how it works, how to use the public instance, and how to run your own Rekor.
- Software Supply Chain
What is Fulcio? An introduction to Sigstore Fulcio
Fulcio is Sigstore's certificate authority for code signing. Learn how it uses OIDC identity tokens to issue short-lived certificates logged in Rekor.
- Software Supply Chain
What are containers?
Learn what containers are, how they differ from virtual machines, what's inside a container image, and how minimal base images reduce size and CVEs.
- Software Supply ChainAppSec
How to prevent software supply chain attacks
Learn how to prevent software supply chain attacks with layered controls over what enters your code, how it's built, and what you release.
- AppSec
AI supply chain attacks: What they are and how to defend against them
Learn how to protect your critical systems against AI supply chain attacks.
- Tools & Buyer’s GuidesDevSecOps
GitHub Actions alternatives: 8 ways to replace or secure unvetted actions
Compare 8 alternatives to unvetted GitHub Actions, including hardened drop-in replacements, SHA pinning, GitLab, CircleCI, and Buildkite, for secure CI/CD.
- Tools & Buyer’s GuidesSoftware Supply Chain
Docker alternatives: Replacing the runtime and the base image
Compare container runtimes and secure base image options like Chainguard, Docker Hardened Images, Bitnami, RapidFort, and Distroless.