The builder had been archived for a year
I went looking for reproducible CI images and found the builder had been archived fourteen months earlier. Swapping it out turned out to be the easy part.
Tags
16 pages
Supply-Chain
Two encrypted emails in twenty years
One of them was from me, testing it. I'd still publish the key, and the reason isn't cryptographic.
The CVE that bumped my dependency for me
Three HIGH advisories deep in a Rust dependency tree, a one-line fix that changed nothing, and eleven minor bumps that were never mine to make.
Publish your key where the platform can't touch it
If the platform hosting your code also hands out the key that verifies it, the signature proves nothing. Where to publish a public key instead.
The marketplace I had to defend from my own attack surface
Opening a public marketplace for agent workflows meant publishing an attack surface, and then having to defend it from my own convenience.
One key, or two?
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
Release trust without the framework
Two new public modules extracting the OpenPGP signing and verification model, so you can use it without adopting the whole framework.
Bought, not stolen
The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.
The interpreter we forgot to sandbox
Hundreds of malicious package versions across three ecosystems, and the uncomfortable fact that installing one runs arbitrary code.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
