Topic

supply chain security

3 posts

Lily in CI: Trying Fuzz-Based Backdoor Detection on a Real Repo

Hands-on Lily (ASE 2026) on an owned C toy: rosa/lily 0.6.0 pin, directed catch of a localhost-bind trigger, clean refactor with zero flags, discovery miss, and CI cost math.

30 Sept 20268 min read

SBOM Signing in CI: How to Sign and Attest With Cosign

One CI shape: build an image by digest, Syft SBOM, Cosign sign + SBOM attest, verify success, and prove wrong-key/unsigned failure — the operational follow-on to after-xz.

29 Sept 20269 min read

Supply Chain Security Checklist for Small Teams After xz

Turn the xz-utils backdoor lesson into action: tarball vs git diffs, SBOM, Sigstore Cosign, SLSA provenance, and a solo/small-team release gate you can run this week.

29 Sept 202610 min read