Explainers: software supply chain
SLSA Build Provenance: What the Levels Actually Prove
What SLSA build provenance records, how Build L1–L3 differ and what verification policy still has to check.
Software Bill of Materials: What an SBOM Proves
An SBOM maps software components. Here is what it can support—and what it cannot prove.
How a Software Dependency Becomes a Security Risk
Direct, transitive, build-time and system dependencies reach your code by different routes. How to list them all.