[Verse 1] In the world of code where dependencies flow Every package needs a name that we can know But names alone won't keep your system tight Version numbers guide us through the night Semantic versioning tells the tale Major dot minor dot patch without fail Breaking changes bump the major high Backward compatible keeps minor fly [Chorus] Name it, version it, hash it true Three pillars holding me and you Cryptographic fingerprints don't lie Supply chain safety reaching for the sky N-V-H, the trinity we trust Component identity or system bust Name it, version it, hash it true Security depends on what we do [Verse 2] But versions can deceive and names can clash That's where cryptographic hashes flash SHA-two-five-six creates the golden key Immutable proof of what we see If one bit changes in the source code tree The hash will shift dramatically No malicious actor can fake the sign When integrity's drawn with crypto line [Chorus] Name it, version it, hash it true Three pillars holding me and you Cryptographic fingerprints don't lie Supply chain safety reaching for the sky N-V-H, the trinity we trust Component identity or system bust Name it, version it, hash it true Security depends on what we do [Bridge] Lock files capture the exact state Pin those hashes, don't leave to fate Reproducible builds across the team Software bill of materials, living the dream From NPM to Maven to Cargo's way Component tracking saves the day [Verse 3] Range operators let us flex and bend Caret means compatible, tilde's our friend But in production lock it down tight Exact versions keep us sleeping right Registry mirrors and private repos Shield us from the winds that trouble blows Verify signatures, check the chain Component identity keeps us sane [Chorus] Name it, version it, hash it true Three pillars holding me and you Cryptographic fingerprints don't lie Supply chain safety reaching for the sky N-V-H, the trinity we trust Component identity or system bust Name it, version it, hash it true Security depends on what we do [Outro] When the supply chain's under attack N-V-H will have your back Three simple rules to memorize Component safety in disguise
← OS Package SBOMs: System-Level Dependency Tracking | Build Metadata and Provenance in SBOMs →