Security Engineering · Cluster
Supply-Chain Security
Build integrity and dependency trust.
- 01 How Dependency Resolvers Turn Version Ranges into a Fixed Graph A manifest states constraints, not versions. Resolution is a search over the version space, and the lockfile is the memoized answer that makes a build repeatable.
- 02 What a SHA-512 Integrity Hash in Package Metadata Actually Proves Subresource Integrity, package lockfile digests, and Go checksums look alike but answer different questions about who computed the hash and what it covers.
- 03 Identity in SBOMs: PURLs, CPEs, and Why Names Do Not Join An SBOM is only as useful as its keys. Component identity schemes disagree about what a component is, and vulnerability matching fails where they disagree.
- 04 Dependency Confusion and the Order Registries Are Consulted When a build resolves a private package name against a public registry, an attacker can claim the name first. The mechanism is registry precedence, not a bug.
- 05 Reproducible Builds: The Sources of Nondeterminism in Compiler Output Two builds of identical source differ because something in the environment leaked into the artifact. The taxonomy of those leaks, and the normalizations that remove them.
- 06 Provenance Attestations and the Digest They Must Bind An attestation is a signed claim about a build. Its value depends on a subject digest that names the exact artifact, a predicate that names the process, and a verifier policy.
- 07 Threshold Roles and Rollback Protection in the Update Framework TUF treats a repository as four roles with separate keys and quorum thresholds. The design turns a compromised signing key into a bounded, detectable incident.
- 08 Keyless Signing and Transparency Logs for Build Artifacts Short-lived certificates bound to an OIDC identity remove long-lived keys from the signing path, and an append-only log makes a signature public evidence rather than a private promise.
- 09 Hermetic Builds: Isolating the Network, the Clock, and the Filesystem A build that can read the network, the clock, or the ambient filesystem is not a function of its source. Isolation removes those channels and makes the input set explicit.
- 10 VEX: Encoding Exploitability So a Scanner Can Stop Guessing A CVE in an SBOM is not a finding. VEX records whether a product is affected and why, with a justification token that a machine can act on and a human can audit.