Tag
hermeticity
- Feb 7, 2025 Trust Boundaries in Shared Build Caches A cache entry written by an untrusted build is an input to a trusted one. How key collisions become code execution, why content addressing does not help, and how namespaces separate the two. devops
- Nov 26, 2022 What a Build Cache Key Must Cover Under-keying produces wrong artifacts that look valid; over-keying destroys the hit rate. How to enumerate the true inputs of a build action, and where the environment leaks in. devops