Tag
supply-chain-security
- Oct 25, 2026 Signed Repository Metadata and the Compromise-Resistant Update Protocol Why a signature on the artifact is not enough, how role-based metadata separates signing keys by function, and what the freshness and freeze defences cost in round trips. software engineering
- Feb 26, 2026 Advisory Ranges, Reachability, and Deciding a Vulnerability Does Not Matter How advisory databases express which versions are affected, why a version range in an advisory is not the same claim as an exploitable dependency, and what evidence supports suppressing a finding. software engineering
- Jan 17, 2026 Install Scripts: The Code That Runs Before the Package Does What package managers execute at install time, why lifecycle hooks exist, and how their privilege, ordering, and failure semantics make them a separate trust boundary from the code being installed. software engineering
- Feb 22, 2025 Artifact Provenance from Commit to Deployed Digest Signed attestations bind an artifact digest to the materials and builder that produced it. What the statement must contain, how it is verified, and which attacks it does not stop. devops
- Feb 7, 2025 Trust Boundaries in Shared Build Caches A cache entry written by an untrusted build is an input to a trusted one. How key collisions become code execution, why content addressing does not help, and how namespaces separate the two. devops
- Dec 9, 2024 Integrity Hashes and Registry Trust What a package digest actually covers, where it is recorded, and which attacks a lockfile digest stops and which it cannot, from republishing to dependency confusion. developer tools
- Jun 18, 2024 How a Package Name Becomes a Download: Registry Lookup Order and Confusion The chain from a bare name in a manifest to a fetched artifact, how registries and scoped namespaces are consulted in order, and why that order is exploitable. software engineering