DevTech Deep Dive

Two primary strategies exist for generating SBOMs using Syft and Grype:

• Build-time: Generate during the build process itself
• Release-time:...

• Root cause: HMAC signature ambiguity in Gitea's Actions Artifacts V4 signed URL implementation
• Exploitation vectors: Actions job execution enables...

The plugin system uses a two-step pipeline with discovery plugins scanning filesystems and publishing events, while collection plugins subscribe via...

Credible container scanning hinges on proving the exact immutable digest assessed matches what runs in production—not just a mutable tag.

• Record...

A connected family of credential- and identity-abuse techniques has targeted open-source tools since September 2025, moving from compromised...

No significant updates today.

• Kubernetes parallel: Telemetry pipelines now deliver control planes for data, decoupling collection from infrastructure like K8s did for...

Combine proactive vulnerability scanning across the full lifecycle with hardened container builds to catch issues early and ship minimal attack...

Two complementary patterns strengthen build integrity and reproducibility:

• Stable JUnit identities plus artifacts:when: always expose recovered...

A solo Flutter developer built a pipeline that keeps templates usable only for paying customers after repeated unauthorized resales of earlier...

SBOM Architectures and CI Integration

• 🔥 PhalanxCyber SBOM Security: Parses lockfiles with pluggable BaseParser for Python/Node/Java/Go, assigns...

Three incidents this year reveal how supply-chain compromises and credential mismanagement converge.

• Injective's npm SDK (v1.20.21) was backdoored...

Skip Maven installs in CI/CD by using curl to push artifacts directly.

• Fetch a CodeArtifact auth token via environment variable
• PUT the JAR: curl...

ModelAudit now requires environment variables exclusively for cloud and registry authentication, improving security by avoiding CLI flag exposure in...

Configure wolfTPM to restrict post-quantum algorithms to specific operations only.

• Use --enable-mldsa=verify-only and --enable-mlkem=enc to drop...

• Provenance reveals an artifact's origin and build process—SBOMs only list contents, letting pipelines reject unsigned or tampered releases.
  -...

Build-Time Attestations & CI Gates

• 🔥 The SBOM you can trust is the one your build actually made: Compares BuildKit in-toto attestations (bound...

Software supply chains are shifting from unverified claims to signed, verifiable attestations at every stage.

• Commit level: World of Code dataset...

Metabase only reads SQL databases, so every SaaS integration needs a pipeline that extracts, loads, models, and visualizes data on a schedule.

Key...

Build System Security Risks

• 🔥 Kotlin Build Cache CVE: CVE-2026-53914 allows code execution via unsafe deserialization in JetBrains Kotlin build...