Skip to content
Standard Reader
Log in
Tag

Sbom

Articles and publications tagged Sbom across the Atmosphere.

9articles4publications
jeffreyciend
jeffreyciendNov 7, 2026
Prioritizing Axios CVE-2026-42037 Across a Node.js Estate
A risk-prioritization framework for Axios CVE-2026-42037 across a fleet of Node.js services.
axiosrisk-prioritization
kozhevnikova
kozhevnikovaOct 29, 2026
VEX should record a vulnerability decision, not create a blanket exemption
An auditable VEX workflow tied to product identity, evidence, and review dates.
VEXSBOM
andreagomez205
andreagomez205Oct 25, 2026
An unsigned SBOM answers a question nobody asked
Why an SBOM without digest-bound signature is a description rather than evidence, and the four verification checks a consumer has to run.
supply-chainsbom
Andrew Nesbitt
Andrew NesbittApr 13, 2026
Common Package Specification
Not the cross-ecosystem format the name suggests.
package-managersmetadata
Andrew Nesbitt
Andrew NesbittFeb 19, 2026
Go Modules for Package Management Tooling
The Go modules behind git-pkgs, rebuilt from my Ruby supply chain libraries.
gosbom
Andrew Nesbitt
Andrew NesbittFeb 8, 2026
Sandwich Bill of Materials
SBOM 1.0: A specification for sandwich supply chain transparency.
package-managerssbom
Andrew Nesbitt
Andrew NesbittFeb 4, 2026
Package Management at FOSDEM 2026
Summary of package management talks from FOSDEM 2026, covering supply chain security, attestations, SBOMs, dependency resolution, and distribution packaging across multiple devrooms.
package-managersconferences
Andrew Nesbitt
Andrew NesbittDec 23, 2025
Could lockfiles just be SBOMs?
Lockfiles and SBOMs record the same information in different formats. What if package managers used SBOMs directly, instead of converting later?
package-managerssbom
Andrew Nesbitt
Andrew NesbittDec 14, 2025
Supply Chain Security Tools for Ruby
Ruby implementations of PURL, VERS, SBOM, SWHID, and SARIF specs.
rubysbom

You've reached the end.