Tag
sbom
- May 3, 2026 VEX: Encoding Exploitability So a Scanner Can Stop Guessing A CVE in an SBOM is not a finding. VEX records whether a product is affected and why, with a justification token that a machine can act on and a human can audit. security
- Mar 2, 2026 Complying With Source Obligations When Shipping Binaries What counts as conveying a copy, how corresponding source is defined for a compiled artifact including its build scripts, and how a build can archive the exact sources and licenses that a shipped binary implies. computing history
- Feb 24, 2026 Identity in SBOMs: PURLs, CPEs, and Why Names Do Not Join An SBOM is only as useful as its keys. Component identity schemes disagree about what a component is, and vulnerability matching fails where they disagree. security
- Nov 5, 2025 SPDX License Expressions and Machine-Readable Provenance How a single identifier grammar replaced prose license statements, what the operators and version suffixes encode, and why the declared license of a package and the licenses of its files routinely disagree. computing history
- May 23, 2024 Referrers, Attachments, and the Artifact Graph How a registry indexes artifacts by the digest they describe, why the fallback naming convention is spoofable, and how a verifier discovers signatures and SBOMs without being told where to look. virtualization