Series

Software Supply Chain Security

A lockfile can repeat a choice. It cannot tell you who was allowed to change the artifact, which inputs executed, or where the credentials went.

  1. Supply-Chain Security Begins with Who Can Change the Artifact
  2. A Lockfile Gives Repeatability, Not Provenance
  1. A Short-Lived Token Can Still Have a Large Blast Radius