News
This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3
This is the third issue of This Week in SBOMs, covering Saturday 31 October to Friday 6 November 2026. Last week was about finding PHP and...
News
This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare
Welcome to the second issue of This Week in SBOMs, marking the first time we cover a standard seven-day period: Saturday 24 October to...
News
This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law
Welcome to the inaugural This Week in SBOMs, a weekly survey of developments within software security, regulation and standards, viewed...
Announcement
Announcing sbomify-action v26.9.0: The One That Runs on Every CI
The action has always claimed to work on any CI system. That was true in the sense that it ran, and false in every sense that matters once...
Announcement
Announcing sbomify-action v26.8.0: The One That Went on a Diet
The headline number in this release is that the container image went from 515MB to 106MB. That is the fun part. The part that should...
Education
What Is a Dependency in Software? A Beginner's Guide
A dependency in software is any external component – a library, framework, module, or package – that your application relies on to function....
Education
Software Supply Chain Management: Risks, Best Practices, and SBOM Integration
Software supply chain management is the practice of identifying, assessing, and mitigating risks across the entire chain of components,...
Education
What Is SLSA? Understanding Supply Chain Levels for Software Artifacts
In 2020, attackers compromised SolarWinds’ build system and injected malicious code into Orion software updates that were distributed...
Education
What Is in-toto? Securing the Software Supply Chain End to End
When the XZ Utils backdoor was discovered in March 2024, it revealed how a malicious contributor could spend years infiltrating an...
Education
What Is Sigstore? Keyless Signing for the Software Supply Chain
Before Sigstore, signing a software artifact meant generating a GPG or PEM key pair, storing the private key securely, distributing the...
Education
Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)
As the digital world grows ever more complex, the tools we use to ensure software security and transparency must evolve. The 2nd edition of...
Education
What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem
After the Log4Shell vulnerability exposed how a single widely-used open source library could affect hundreds of thousands of organizations,...