Glossary

Terms as they are used here. A few of these are genuinely contested, and a few more are used by vendors and by engineers to mean different things; where that is the case the entry says so rather than picking a winner quietly.

Artefact

The thing a build produces and a deployment consumes — a binary, an image, a package, a bundle. Distinguished from source throughout these essays because nearly every control teams apply operates on source while production runs the artefact.

Attestation

A signed statement about an artefact rather than merely over it: typically binding the artefact’s digest to the source commit, the builder identity and the build parameters. Only useful if something verifies it before the artefact is allowed to run.

Build agent

The machine or container that executes a build. Security-relevant mainly because of what it holds — registry credentials, signing keys, cloud tokens — and because any code the build resolves can run on it.

Content digest

A cryptographic hash of an artefact’s bytes, used as its identity. Immune to the renaming and re-tagging that makes version labels unreliable, which is why policies that matter are written against digests rather than tags.

Delta gate

A build check that fails only when a change introduces a new finding, rather than when the codebase contains findings. The only gating configuration that survives contact with an existing backlog.

Dependency confusion

Causing a resolver to fetch a package from a public registry when an internal one of the same name was intended. A configuration and namespace problem rather than a flaw in any package.

Direct dependency

A package your manifest names explicitly. Contrast with transitive: the ratio between the two is usually an order of magnitude or more.

Hermetic build

A build that declares all its inputs in advance, fetches and verifies them before starting, and then runs without network access. The precondition for both complete provenance and reproducibility.

Install hook

Code a package runs at install time rather than at import time. The reason a dependency can affect a build machine without ever being called by your application.

Lockfile

A record of the exact resolved dependency graph, usually with integrity hashes. Stops the graph moving on its own; makes no claim whatsoever about whether its contents are safe.

Manifest

The file declaring what a project depends on and under what constraints. The short list, as against the lockfile’s long one.

Provenance

Used two ways. Narrowly: the machine-readable record of how an artefact was produced. Broadly: the whole practice of making the source-to-artefact path checkable. This site means the narrow sense unless the context says otherwise.

Range expression

A constraint such as ^1.2.3 or >=1.2 <2.0 that pre-authorises a set of future versions. Enforced arithmetically; the compatibility it assumes is a social convention, not a verified property.

Reachability

Whether a vulnerable code path can actually be entered from your application. The most useful triage filter available and an inherently probabilistic one, since reflection, dynamic dispatch and configuration-driven loading all defeat static call-graph analysis.

Reproducible build

A build that produces byte-identical output from the same inputs on any machine. The only check on a build system that does not require trusting the build system.

Risk acceptance

A recorded decision not to fix something, with a stated reason, a named accepter and an expiry. Without a supported path for this, teams improvise one using suppressions and closed tickets, and the reasoning is lost.

Rotation

Replacing a credential with a new value and invalidating the old one. The only actual remediation for an exposed secret; deletion and history rewriting are cleanup.

SBOM

A list of the components in an artefact. Contested in practice: it is variously expected to be an inventory, a vulnerability report, a licence audit and a compliance deliverable, and a document produced for one of those purposes is often disappointing for the others. Its accuracy also depends heavily on whether it was generated from the build or inferred from the finished artefact.

Secret scanning

Detection of credentials in source, history or logs. High-confidence for structured tokens with recognisable formats; heuristic and noisy for everything else.

Shift left

Moving security work earlier in the development process. Used descriptively to mean “give developers the feedback while they are still in the code”, and used loosely to mean “move the work onto developers”, which is a different and much less popular proposition.

Signing

Proving that a holder of a private key performed an operation over specific bytes. Establishes who, not what happened — a signature from a compromised build system is a valid signature.

Software supply chain

Everything that contributes to what you ship but was not written by you: dependencies, base images, build tools, compilers, actions and plugins, and the registries and accounts that distribute them.

Suppression

Marking a finding as not-to-be-reported. Distinguished from risk acceptance mainly by whether the reasoning and an expiry were recorded; in most tools nothing forces either, which is how backlogs shrink without anything being fixed.

Transitive dependency

A package pulled in by another package rather than chosen by you. Most of the graph, and most of the code that ends up running.

Trust set

The full collection of parties who can change what you ship without your involvement: every publisher in the resolved graph, everyone with commit or release rights, and everyone who can compromise one of those accounts.

Typosquatting

Publishing a package under a name close to a popular one, relying on a mistyped manifest entry. Cheap for the attacker because the name is the only identifier most resolution paths check.

Vendoring

Committing dependency source into your own repository. Trades the graph moving under you for owning the update burden yourself; a real trade rather than a strict improvement.

Verification gate

The point at which an artefact failing policy is actually refused. A pipeline that produces signatures but has no gate has a generation pipeline, not a verification one — a distinction easily settled by trying to deploy something unsigned.