Andre Lustosa

ANDRE LUSTOSA / TAG

#supply-chain

2 entries with this tag.

  1. Hermetic Builds Begin at the Acquisition Boundary

    A build becomes explainable when every network-dependent input is acquired explicitly, recorded, and separated from the steps that construct the artifact.

  2. A Release Has Three Trust Decisions

    Version identity, permission to publish, and artifact integrity answer different questions. A release pipeline is trustworthy only when it connects all three.

← All writing