Software Supply Chain Lexikon

Die Software Supply Chain umfasst eine hohe Anzahl an Anwendungsfällen, Programmiersprachen, Libraries, Package Managern, Toolchains, Vokabular, Abkürzungen und Rollen. Um diese Themen so verständlich wie möglich zu machen, stellen wir hier in unserem Lexikon Infos zu, und Verbindungen zwischen all den Begriffen, Elementen und Ressourcen her, die dieses Technologiefeld charakterisieren.

In manchen Fällen kann ein Wort auch mehrere Bedeutungen haben. Wir versuchen in diesem Lexikon stets, verschiedene Perspektiven zu berücksichtigen und die Begriffe im Kontext der Software Supply Chain oder ihrer Absicherung sowie der Bezüge zu DevOps, DevSecOps, Cloud-Native, SDLC oder MLOps so gut wie möglich zu erklären.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

Artifact

Any new object produced as a result of software development. This could mean a compiled binary, the project's source code, container...

B

Binär-Repository-Manager

Ein Tool, mit dem Sie Ihre kompilierten Binärdateien auf die gleiche Weise wie Ihren Quellcode in Repositorys organisieren können,...

Binary

The file that results from compiling your code, if written in a language that is compiled rather than interpreted.

Build

As a verb, to compile your source code into an executable binary. As a noun, a version of your application as an executable binary.

C

CI/CD

The combination of Continuous Integration and either Continuous Deployment or Continuous Delivery. Broadly, this is the term for a set...

Compiler

A tool that translates an entire application written in one higher-level programming language into another lower-level language so that...

Container

A virtualized operating system environment that includes your application and its dependencies, allowing you to have a greater level of...

Continuous Delivery

A philosophy that your software updates should be continuously delivered to the target, although deployment to the user is still...

Continuous Deployment

Like Continuous Delivery, a philosophy that your software updates should be continuously delivered to the target. However, Continuous...

Continuous Integration

Enabled by a Continuous Integration tool like JFrog Pipelines, merging all developers’ working codebase with the source, multiple...

CVE

Common Vulnerabilities and Exposures (CVE) ist ein Verzeichnis eindeutiger Kennungen (CVE-ID), die offengelegten Sicherheitslücken im...

CVSS

Common Vulnerability Scoring System. A numerical score on a scale from 1 to 10, representing the potential severity of a software...

D

Dependency

Code, librarties, or tools that your application relies on to operate. May or may not be written by a third party.

DevOps

DevOps is the term for the union of the development team and the IT operations team, through the use of a specific set of practices and...

DevSecOps

DevSecOps ist die Integration kontinuierlicher Sicherheitstests in jede Phase des Software-Lebenszyklus (SDLC). Im Rahmen eines...

Docker

A virtualization tool that allows you to deliver your software in a particular type of package called a container, which includes an...

H

Helm

A package manager for Kubernetes. Written in YAML, a Helm chart allows you to define, install, and upgrade complex Kubernetes...

I

Infrastructure As Code

A tool that allows you to manage and provision infrastructure such as containers and network configuration through your code, in a way...

Integration Tests

A type of testing that verifies entire parts of an application work when combined with other parts of an application.

Interpreter

A tool that translates source code in a higher-level language into a lower-level language for execution, line-by-line, at runtime....

K

Kubernetes

A container orchestration tool designed to make the deployment and management of containerized applications easier. Think of it like the...

L

License

A legal document that defines how a piece of software may be used, and what the implications are for using it. Licenses may define rules...

Local Repository

In the context of JFrog Artifactory, a particular type of repository that contains code originating on your local machine. Does not...

M

Microservice

A software development architecture that breaks your application up into multiple independent services that interact with one another....

Model Registry

Ein Model Registry ist ein zentrales Repository in MLOps (Machine Learning Operations), in dem der Lebenszyklus von Machine...

Monolith

A software development architecture wherein your application is built as a single unit -- front-end, back-end, and database. Until...

N

NuGet

NuGet ist ein häufig verwendeter Paketmanager, der das Abhängigkeitsmanagement vereinfacht, indem er Entwicklern ermöglicht,...

P

Paketverwaltung

Pakete sind Codesammlungen, die zur Erweiterung der Funktionalität einer Anwendung verwendet werden.

R

Remote Repository

In the context of JFrog Artifactory, a repository type that contains only remote code with an original source outside of your local...

Repository

A place to organize your source code or artifacts into one cohesive, organized group by application or project. Tools like GitHub are...

S

SAST

SBOM

Eine Software Bill of Materials (SBOM) ist eine Liste aller Komponenten & Abhängigkeiten, die in einer Anwendung verwendet...

SCA

SCA-Tools scannen Software, und eruieren, welche Abhängigkeiten und andere Inhalte darin vorhanden sind, und identifizieren dann die...

Schwachstellen-Scanning

Beim Schwachstellen-Scanning wird ein System, ein Netzwerk oder eine Applikation automatisch durchsucht, um bekannte Schwachstellen zu...

Schwachstellenmanagement

Unter Schwachstellenmanagement oder Vulnerability Management versteht man das Entdecken, Identifizieren, Priorisieren und schließlich...

SDLC

Der Software-Lebenszyklus beschreibt den gesamten Prozess der Entwicklung und Verwaltung von Software von der Idee über die Entwicklung...

Service Mesh

A tool that makes it easier to monitor and control the flow of information between the microservices that make up your application. This...

Software Artifact

A software artifact is any item produced during the development of software, whether tangible or...

Software Supply Chain

Die Software-Lieferkette umfasst alle Personen, Prozesse und Technologien, die an der Entwicklung, der Bereitstellung und der Wartung...

Source Control

A tool that helps manage your uncompiled source code into repositories. Examples are GitHub or Bitbucket.

U

Unit Tests

A type of test that aims to verify functionality within a very specific, narrow scope, e.g., a specific function or class.

V

Virtual Repository

In the context of JFrog Artifactory, a type of repository that acts as an envelope around the local and remote repositories that make up...

Y

YAML

A data serialization language designed to be human-readable, frequently used for configuration files in DevOps and beyond.

Z

Zero-Day Schwachstelle

Eine Zero-Day-Schwachstelle oder Zero-Day-Lücke ist eine Schwachstelle, die noch nicht entdeckt oder offengelegt wurde. Das bedeutet,...