#Sbom — Kunal Ganglani

Rust Reproducible Builds + SBOM + Signed Artifacts [2026]

A 2026-ready Rust release pipeline: pin toolchains, make builds reproducible, gate deps with cargo-vet, generate SBOM + SLSA provenance, and sign everything with keyless cosign.

Keep exploring

Close to this topic, not on this page.

How to Build a Rust Version Bump Tool [2026 Tutorial] Build a CI-safe Rust release toolchain: semver bump rules, workspace updates, changelog generation, annotated/signed git tags, and… 8 min read
Bun lockfile bun.lockb format: Threat model + CI checks [2026] bun.lockb made Bun installs fast, but it also changed how you audit dependency drift. 9 min read
How to Set Up gitleaks + pre-commit + CI [2026] A terminal-first, defense-in-depth secrets workflow for 2026: staged-only hooks, CI full-history scans, baselines for legacy repos, and… 8 min read