Container Image Digests: Pin the Artifact Without Freezing Maintenance
Pin reviewed container image digests, distinguish indexes from platform images, verify deployed content, and maintain an owned update process.
Hackbitez journal
Tag: Supply chain security
Pip Hash-Checking: Approve Exact Artifacts, Not Just Version Names
Use pip hash-checking with complete dependency pins, reviewed artifacts, explicit enforcement, and supported wheels for repeatable installs.
CycloneDX SBOMs: Build a Release Inventory You Can Actually Use
Tie software inventories to exact releases, document dependency uncertainty, and connect advisories to accountable remediation.
Software Artifact Attestations: Verify Provenance Before You Deploy
Learn what GitHub artifact attestations verify, how trust policy matters, and why provenance is not a guarantee of vulnerability-free software.