As leaders in software composition analysis (SCA), we know its role throughout today’s software supply chain. SCA was born out of necessity. How else could innovators discover, identify, and track open source software (OSS) components within their applications? SCA may be best known for tracking capabilities, such as adherence to ... Read More

Recent malware installed in PyPI underscores the need for code verification at the code repository level to defend the software supply chain ... Read More

Mark Dodgson, Sonatype software engineer (@mdodgson76), will test his limits starting this Sunday, July 21, in the Deca Ironman event in York, England ... Read More

Discussions of DevOps in government are always popular because it is a tough subject. Few have successfully cracked the code, and, even if they have, it is a slow, uphill climb with unique challenges ... Read More

We recently released the fifth annual State of the Software Supply Chain Report in London. This year, we worked with Gene Kim and Dr. Stephen Magill to examine our largest data sample ever. Our goal? To qualify and quantify how exemplary development teams operate ... Read More

You're probably familiar with JVM, or the Java Virtual Machine. It's a standard diagnostic interface used to test Java software; so standard, in fact, that Mykel Alvis (@mykelalvis) of Array Consulting urges developers to think beyond its testing capabilities. They need to think about repository managers ... Read More

Siamak Sadeghianfar (@siamaks), Product Manager at RedHat, did shared details about two brand-new open source projects, OpenShift and Tekton, at the 2019 Nexus User Conference. These projects, inspired by Jenkins, aim to standardize Kubernetes CI/CD pipelines in a way that wasn’t possible before ... Read More

Oliver Milke (@OliverMilke) of Cloudogu (@Cloudogu) thinks it is time to think differently about the way to provision and operate a DevSecOps toolchain. He outlined his ideas and showed how they could be done, step-by-step, at the Nexus User Conference ... Read More

Santi Mulukutla, Customer Success Engineer at Sonatype, invites you to embrace ambiguity. Building a successful software supply chain means developing a framework. Most importantly, that framework should be flexible and scalable. It should continue to prompt questions to keep your team moving forward. In other words: a framework for change ... Read More

How do you foster the cultural change necessary to implement DevSecOps? ... Read More