Supply chain
Articles tagged Supply chain — notes and deep-dives grouped under this topic.
-
Production Dockerfile: distroless, build cache and secrets
A checklist of about ten lines: what ships to production and what stays in the builder stage. Measured base images, BuildKit cache mounts, secrets that never reach a layer and attestations that arrive on their own.
-
Cyber Resilience Act: why you need an SBOM by September 2026, not 2027
Everyone is watching December 2027, but vulnerability reporting starts a year earlier — and you cannot report what your inventory cannot list.
-
SLSA L0–L3 and provenance: a chain of trust from commit to admission
An SBOM tells you «what's inside», a signature tells you «who signed». Between them sits provenance — «how it was built». After SolarWinds that's the question admission has to ask.
-
DevSecOps in five stages: from secret-scan to admission policy
Five CI stages with exit-code 1 plus a cluster-side admission gate — the only pattern under which DevSecOps actually blocks production instead of running as a green-checkmark ritual.