Software Supply Chain Glossary
A comprehensive collection of terms, concepts, and definitions related to software supply chain management.
C
Container Bill of Materials (CBOM)
A structured inventory that documents all components, dependencies, and configuration details within a container image, enabling enhanced visibility and security throughout the container lifecycle.
CI/CD (Continuous Integration / Continuous Deployment)
A set of practices and tools that automate the process of building, testing, and deploying software, enabling frequent and reliable software delivery.
CI/CD Security
The practice of protecting continuous integration and continuous delivery pipelines from security threats, ensuring that automated software delivery processes don't introduce vulnerabilities into applications or infrastructure.
Cybersecurity and Infrastructure Security Agency (CISA)
A federal agency responsible for improving cybersecurity across government and critical infrastructure sectors, coordinating national cyber defense, and providing guidance on emerging security threats.
Code Signing
The process of digitally signing executables and software packages to verify the author's identity and ensure the code hasn't been altered or corrupted since signing.
Commons Clause
The Commons Clause is a license condition that restricts commercial use of software when applied to an existing open source license, creating a source-available approach.
Copyleft Licenses
Open source licenses that require derivative works to be distributed under the same or compatible license terms, ensuring that modifications remain freely available to the community.
Cryptography
The practice and study of techniques for securing communication and data through the use of mathematical algorithms, enabling confidentiality, integrity, authentication, and non-repudiation in software systems.
CycloneDX
CycloneDX is a lightweight SBOM standard designed for application security contexts and supply chain component analysis.