Browsing Tag
software supply chain
6 posts
The Poisoned Macchiato: Signing Java SBOMs with Cosign
A poisoned macchiato as a metaphor for your Java image: why multi-stage Docker builds hide their build stages from the SBOM, how BuildKit SBOM attestations with BUILDKIT_SBOM_SCAN_STAGE bring them back, and how Cosign signs the result and publishes each SBOM as a verifiable OCI referrer.
The Myth of Stability: Java’s Software Supply Chain After Log4Shell
For as long as most Java developers can remember, we’ve lived inside a comforting story about our ecosystem.…
Move Fast, Break Laws: AI, Open Source and Devs (Part 4)
The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As…
Move Fast, Break Laws: AI, Open Source and Devs (Part 3)
Background The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends.…
Move Fast, Break Laws: AI, Open Source and Devs (Part 2)
The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As…
Move Fast, Break Laws: AI, Open Source and Devs (Part 1)
The software development landscape is rapidly changing, with legislation emerging as a key driver of industry trends. As…