Supply Chain - Tag - vo.rs

SBOM: Software Bill of Materials and Why You Should Care About Your Dependencies

Fri, 21 Nov 2025 07:00:00 +0000

Every time a serious supply-chain vulnerability lands, the same scramble begins. Someone in a chat channel asks “are we affected?” and the honest answer, for most teams, is “give us a few days and we’ll tell you.” That few days is the gap an SBOM is meant to close. A Software Bill of Materials is just an inventory — a machine-readable list of every component that went into a build — but having one ready before the panic is the difference between an afternoon and a fortnight.

Sigstore and Cosign: Verifying Container Images Before They Run

Fri, 17 Oct 2025 14:00:00 +0000

A container tag is a lie you’ve agreed to believe. nginx:latest today and nginx:latest next week can be entirely different bytes, and a tag tells you nothing about who built the image or whether it’s been swapped underneath you. The whole modern supply-chain panic — compromised build pipelines, typosquatted images, dependency confusion — comes down to that one weak link: we run images we can’t actually verify. Sigstore, and its CLI cosign, is the most practical fix I’ve adopted, mostly because it finally killed the part of signing that everyone hated: key management.

Supply Chain Attacks: From npm Typosquatting to Poisoned Container Images

Tue, 12 Nov 2024 09:00:00 +0000

The most effective way to attack a company isn’t to break down its front door. It’s to be standing inside the delivery van that the company waves through the gate every morning. Supply chain attacks work because they exploit the one thing every developer does without thinking: pull in code and images they didn’t write, from people they’ve never met, and run them with full trust.

You did it this morning. npm install. docker pull. pip install. Each one is an act of faith that the thing at the other end is what it claims to be and hasn’t been tampered with since you last looked. Mostly that faith is rewarded. The supply chain attacker’s entire business is the times it isn’t.