Software-Supply-Chain on Brian Faust

A Short-Lived Token Can Still Have a Large Blast Radius

Thu, 01 Jan 2026 00:00:00 +0000

The release job has no stored cloud key. It asks GitHub for an identity token, exchanges that token for a five-minute production credential, deploys, and lets the credential expire.

A compromised dependency runs in the same job. It can use the same identity request interface and deploy while the credential is live. Five minutes is short for an attacker waiting outside the build. It is generous for code which is already executing inside it.

A Lockfile Gives Repeatability, Not Provenance

Mon, 01 Dec 2025 00:00:00 +0000

composer install exits successfully. It selects the version in the committed lockfile, downloads an archive whose checksum matches, generates the autoloader, and produces the same output on a second clean install.

The output is EXFILTRATED.

Nothing about that result means Composer ignored the lock. The lockfile was updated to select the malicious package and its correct checksum. Composer then repeated that decision exactly.

This is the useful boundary of a dependency lock. It records a resolution. It can make later installations select the same versions, references, metadata, and declared distribution bytes. It cannot prove who deserved to publish those bytes, why the update was approved, what package code will do, whether new advisories exist, or which artifact a consumer eventually executes.

Supply-Chain Security Begins with Who Can Change the Artifact

Sat, 01 Nov 2025 00:00:00 +0000

quote-tool.bin has a valid signature. Its provenance names the expected source revision, dependency lock, workflow digest, and builder. The signature verifies against the consumer’s trusted fixture key.

The program is still malicious.

In the SEC-01 fixture , the authorized builder changes the artifact after the tests pass and signs the resulting digest. Signature verification succeeds because the statement is authentic. Consumer policy rejects the artifact because its digest does not match the independently reproduced output.