Supply Chain
32 items tagged with "supply-chain"
Standards2
CycloneDX 1.7 (SBOM)
A bill-of-materials standard for software, hardware, services, and machine learning models. 1.7 is published as the second edition of Ecma-424 and broadens attestation and cryptographic inventory support.
SPDX 3.0.1
An ISO-standardised bill-of-materials format for communicating software composition, licences, and provenance. 3.0.1 is a maintenance release of the 3.0 model, which reorganised SPDX into profiles covering security, licensing, build, and AI/data.
Tutorials9
How to sign and verify container images with Cosign
Sign images with Cosign and enforce signature verification in Kubernetes for a secure software supply chain.
How to generate an SBOM in your CI pipeline
Produce a software bill of materials for every build in CI and attach it as an artifact for compliance and security.
How to sign container images with Cosign
Sign and verify container images with Cosign keyless signing to secure your software supply chain.
How to automate dependency updates in CI
Configure automated dependency update pull requests with grouping, scheduling, and auto-merge for safe updates.
Export a CycloneDX SBOM with Vibgrate CLI
Generate a standards-compliant CycloneDX SBOM from your project in one command and write it to a file ready for sharing or archival.
Review Dependency Risk Findings with Vibgrate CLI
Run the Dependency Risk Scanner to surface deprecated packages, native modules, and platform-specific dependencies, then review the findings.
Surface Known-Vulnerable Dependencies with Vibgrate CLI
Use the Security Posture Scanner to surface audit counts and structural security hygiene, exporting results to SARIF for code scanning.
Use the Dependency Risk Scanner in Vibgrate CLI
Learn what the Dependency Risk Scanner classifies and how to run a focused scan to inventory deprecated, native, and platform-specific packages.
Verify Supply-Chain Posture Before Shipping
Run a pre-ship checklist with Vibgrate CLI: scan with a gate, review risk and security findings, and export an SBOM before release.
Playbooks2
DevSecOps Program Playbook
A program to embed security into the software lifecycle with shift-left scanning, secure pipelines, and shared ownership between dev, sec, and ops.
Software Supply Chain Security Program Playbook
A program to secure the build-to-deploy pipeline with SBOMs, artifact signing, provenance attestation, and SLSA-aligned controls.
Regulations4
Network and Information Security Directive 2
EU directive on cybersecurity measures across the Union
Cybersecurity Maturity Model Certification
US Department of Defense program requiring defense contractors to certify cybersecurity maturity to protect controlled unclassified information.
Trusted Information Security Assessment Exchange
Automotive-industry information-security assessment and exchange mechanism based on the VDA ISA catalogue, used across the supply chain.
UK Telecommunications (Security) Act 2021
UK law imposing strong security duties on public telecoms providers to protect networks and services against cyber and supply chain threats.
FAQs4
How do I export SBOMs from Vibgrate scans?
Use vg sbom export to emit CycloneDX or SPDX SBOMs from scan artifacts. Example: vg sbom export --format cyclonedx --out sbom.cdx.json. Use vg sbom de...
What is an SBOM (software bill of materials)?
An SBOM is a formal, machine-readable inventory of all components, libraries, and dependencies that make up a piece of software, including their versi...
What is software supply-chain security?
Software supply-chain security protects the integrity of everything that goes into building and delivering software: source code, third-party dependen...
How do I prove an SBOM from Vibgrate is authentic?
In Vibgrate Cloud, the SBOM Hub can export your SBOM wrapped in a signed attestation — an in-toto Statement in a DSSE envelope whose subject is the SB...
Glossaries8
Software Bill of Materials (SBOM)
A software bill of materials is a formal, machine-readable inventory of all components, libraries, and dependencies that make up a piece of software, along with their versions and relationships.
Software Supply Chain Security
Software supply chain security is the practice of protecting every stage of building and delivering software, from dependencies and build systems to distribution, against tampering and compromise.
Attestation
An attestation is a signed, machine-readable statement about a software artifact — such as how it was built or what it contains — that a consumer can cryptographically verify.
Provenance
Provenance is verifiable metadata that records where a software artifact came from and how it was built — its source, build system, and inputs — so consumers can trace and trust it.
DSSE (Dead Simple Signing Envelope)
DSSE is a standard format for wrapping a payload together with its signature so the signed content and its type are bound and tamper-evident.
SLSA (Supply-chain Levels for Software Artifacts)
SLSA is a security framework that defines graduated levels of build integrity and provenance for software artifacts, so teams can measure and improve how trustworthy their builds are.
Common Vulnerabilities and Exposures (CVE)
CVE is a public, standardized catalog that assigns a unique identifier to each publicly disclosed cybersecurity vulnerability, enabling consistent reference across tools and organizations.
Lockfile
A lockfile records the exact, resolved version of every dependency in a project — direct and transitive — so installs are reproducible and the true dependency set is auditable.