Tags

14 pages

Supply-Chain

A signing key needs somewhere to live

A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.

Waivers with an expiry date

A vulnerability scanner is a one-day yes or no. Running cargo-deny as a standing policy gate instead, with waivers that expire on a date.

Verifying your own downloads: how I solved it for self-updating CLI tools

Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.

OpenSSF Scorecard graded my supply chain

Running OpenSSF Scorecard on a Go project flagged mutable action tags, over-broad workflow token permissions, and a missing maintenance signal.