Skip to content
Standard Reader
Log in
Tag

Supply-chain

Articles and publications tagged Supply-chain across the Atmosphere.

22articles1publication
Andrew Nesbitt
Andrew NesbittSep 22, 2026
Unfinished Work in Package Security
Some assembly required.
package-managerssecurity
Andrew Nesbitt
Andrew NesbittSep 15, 2026
Shadowing the Standard Library
export PYTHONSAFEPATH=1
securitysupply-chain
Andrew Nesbitt
Andrew NesbittSep 10, 2026
Package Manager Trends
min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.
package-managerssupply-chain
Andrew Nesbitt
Andrew NesbittJun 29, 2026
Unbundling the standard library
Batteries no longer included, available separately on aisle four
package-managerssecurity
Andrew Nesbitt
Andrew NesbittJun 11, 2026
What Happened to tea.xyz
Reading the tea leaves
package-managerssupply-chain
Andrew Nesbitt
Andrew NesbittJun 4, 2026
gittuf - a signed log for git refs
Branch protection is a row in someone else's database
gitsecurity
Andrew Nesbitt
Andrew NesbittMay 29, 2026
Composer's dependency policies
uBlock Origin for composer install
package-managerssecurity
Andrew Nesbitt
Andrew NesbittMay 28, 2026
Protestware for coding agents
printMessageForCodingAgents()
supply-chainsecurity
Andrew Nesbitt
Andrew NesbittMay 25, 2026
GitHub Actions security in Python packages
Thank you Dr. Zizmor
securitysupply-chain
Andrew Nesbitt
Andrew NesbittMay 24, 2026
Signing is for the bad days
TUF, in-toto, and Sigstore only look pointless while nothing is on fire
supply-chainsecurity
Andrew Nesbitt
Andrew NesbittMay 22, 2026
Dependency Pruning
A survey of unused-dependency detectors
supply-chaindependencies
Andrew Nesbitt
Andrew NesbittMay 19, 2026
Dumb Ways for an Open Source Project to Die
How your dependencies became Bernies
open-sourcemaintainers
Andrew Nesbitt
Andrew NesbittMay 15, 2026
Language Registries Are Unstable by Default
apt install -t unstable, but make it your whole personality
package-managerssecurity
Andrew Nesbitt
Andrew NesbittMay 8, 2026
Weekend at Bernie's
Which of your dependencies are wearing sunglasses
open-sourcesecurity
Andrew Nesbitt
Andrew NesbittMay 7, 2026
Free as in Tribbles
The next metaphor after free-as-in-puppy
open-sourcedependencies
Andrew Nesbitt
Andrew NesbittApr 28, 2026
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
githubsecurity
Andrew Nesbitt
Andrew NesbittApr 15, 2026
The Tuesday Test
Like the Turing test but with more tacos.
package-managershomebrew
Andrew Nesbitt
Andrew NesbittApr 7, 2026
Who Built This?
Tracing a dependency back to its source commit.
package-managerssecurity
Andrew Nesbitt
Andrew NesbittMar 19, 2026
The Fragmented World of Dependency Policy
Every tool that makes automated decisions about dependencies invented its own policy format. There are standards for describing software components but none for writing rules about them.
package-managerssupply-chain
Andrew Nesbitt
Andrew NesbittMar 12, 2026
Reviewing ENISA's Package Manager Advisory
Notes on ENISA's Technical Advisory for Secure Use of Package Managers.
package-managerssecurity
Andrew Nesbitt
Andrew NesbittMar 11, 2026
git-pkgs/actions
How to add git-pkgs to your GitHub Actions workflows.
git-pkgsgithub-actions
Andrew Nesbitt
Andrew NesbittFeb 4, 2026
Package Management at FOSDEM 2026
Summary of package management talks from FOSDEM 2026, covering supply chain security, attestations, SBOMs, dependency resolution, and distribution packaging across multiple devrooms.
package-managersconferences

You've reached the end.