“supply-chain”
The Rise of OCI Artifacts: From Images to Anything
OCI's image and distribution specs now carry Helm charts, SBOMs, signatures, Wasm modules and model weights — not just container images. Here is how media types, the referrers API and ORAS turn any registry into a universal artifact store.
SBOMs at Scale: SPDX, CycloneDX, and Registry Integration
Generating a bill of materials is easy; operating millions of them is not. This post compares SPDX 2.3/3.0 with CycloneDX 1.5/1.6, shows how to produce SBOMs with syft and Trivy, and covers storing them as OCI artifacts in your registry and querying them at scale.
Cosign and Sigstore: Signing Images at the Registry
A hands-on Sigstore tutorial: keyless signing with Fulcio and Rekor, keypair signing, signing a pushed image by digest, verifying in CI and at deploy, and attaching SBOM attestations.
Build Secrets with BuildKit: Keeping Credentials Out of Layers
Why ARG and ENV secrets stay permanently in image history, and how RUN --mount=type=secret plus the --secret flag keep credentials out of layers.
Gemini 3 in Supply Chain: Predictive Reasoning for Global Logistics
Reactive supply chains are dead. Use Gemini 3 to reason over multimodal logistics signals and predict disruptions before they become port-wide delays.