How to Convert Your SBOM Between SPDX and CycloneDX Formats
7 minute read time
A step-by-step guide on how to convert between SBOM formats using tooling from the official repositories of SPDX and CycloneDX.
Read More...
Post-Conference Tech Spec: Why Building Your Ship (Application) with Raw Materials is a Bad Idea
12 minute read time
Get all the details of the presentation that Jamie Coleman, Developer Advocate on Sonatype’s Developer Relations team, gave at Voxxed Days Zurich 2023.
Read More...
Best Practices in Dependency Management: Cooking a Meal of Gourmet Code
5 minute read time
Close to 85% of every application is open source software. Better understanding your software supply chain starts with understanding dependency management.
Read More...
SCA and SAST: What Do They Do and How Can They Help Developers Like You?
5 minute read time
SCA and SAST tools help DevSecOps teams and application developers work together to identify vulnerabilities and improve security.
Read More...
How does Developer Morale Affect My Software Supply Chain?
4 minute read time
Your place in the software supply chain has a lot to do with your development staff. A look at Sonatype data on developer state-of-mind and performance.
Read More...
PGP vs. sigstore: A Recap of the Match at Maven Central
7 minute read time
We put code-signing tools PGP and sigstore in a head-to-head match with Maven Central users to find a winner. The results may surprise you.
Read More...
What do Log4Shell and a Global Pandemic Have in Common?
4 minute read time
A look at development through the lens of weddings, including long-term planning, contingencies, and disasters. A video talk from this years DEVOXX.
Read More...
HID Global's Three Pillars of Operational Security
5 minute read time
The foundations of security at HID Global are a balanced set of tools, policies, and expertise. A look back at a DevSecOps Leadership Forums talks in Paris.
Read More...
What Constitutes a Software Supply Chain Attack?
6 minute read time
ENISA feels the term software supply chain attack is overused, so what does constitute a supply chain attack?
Read More...