Software Supply Chain Security and DevSecOps
Code review passed. The scan was green. The artifact was signed. None of those answered whether what shipped was what anyone had chosen.
-
-
Software Bill of Materials
A parts list is not a verdict. Knowing a component is present is a different statement from knowing you are affected by a vulnerability in it.
-
Dependency Confusion
Your build asked for an internal package name. A public candidate met the selection rules and displaced the intended package.
-
Build Provenance
Provenance answers where this came from and how. Unverified it is metadata; checked against expectations it is a reason to refuse an artifact.
-
Testing and Reviewing AI-Generated Code in CI
Generated code can pass its own tests and still be wrong. Build CI checks that stay independent of the generator, and define what a human must approve.
-
Software Supply Chain Controls
A delivery pipeline pulls in code, packages, base images, and actions it did not write. This post builds the controls that identify, verify, and bound those inputs.
-
Reproducible Builds and Immutable Artifacts
Which exact bytes are running in production, and could you build them again? This guide covers dependency locking, deterministic builds, provenance, immutable artifacts, and configuration boundaries, with examples and the output of local runs.