Tag
supply-chain
- Aug 5, 2026 Content Addressing and What Artifact Hashes Actually Prove The difference between a hash that identifies bytes and a signature that identifies a publisher, how digest verification fails, and why a matching hash is a narrower guarantee than it appears. language runtimes
- Jan 26, 2026 Provenance Attestations and the Trust Boundary of a Package Install What an in-toto attestation binds together, how transparency logs change the meaning of a verified install, and which attacks remain outside the model. language runtimes
- May 13, 2025 Reproducible Mobile Builds and Independent Artifact Verification Which build inputs leak into a mobile binary, how path and timestamp normalisation makes two builds comparable, and what a third party can actually prove by rebuilding. mobile computing
- Dec 17, 2024 Subresource Integrity and the Trust Chain for Third-Party Scripts How the integrity attribute verifies fetched bytes, why cross-origin scripts need CORS for the check to run, and what hash pinning does and does not protect against. web platform
- Dec 28, 2022 Immutable Artifact Coordinates and Why Digests Matter How a version-plus-repository name identifies a byte string, what breaks when the mapping can change, and how attestations bind a build input set to the digest that was published. devops
- Mar 30, 2022 Known-Good-Die and the Trust Problem in Multi-Die Assembly Why assembling individually working dies does not produce a working module, what a stack test standard can and cannot verify, and what must move on-die to make multi-die packages economical. hardware engineering