Bought, not stolen
The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.
Tags
19 pages
Supply-Chain
The interpreter we forgot to sandbox
Hundreds of malicious package versions across three ecosystems, and the uncomfortable fact that installing one runs arbitrary code.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
Anything under an 8
The national vulnerability database is buckling under defunding and volume, which changes what a severity score is actually worth.
Nobody's coming to clean your supply chain
Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.
A signing key needs somewhere to live
A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.
Waivers with an expiry date
A vulnerability scanner is a one-day yes or no. Running cargo-deny as a standing policy gate instead, with waivers that expire on a date.
Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
OpenSSF Scorecard graded my supply chain
Running OpenSSF Scorecard on a Go project flagged mutable action tags, over-broad workflow token permissions, and a missing maintenance signal.
