Supply-chain security: free-recall review
Free-recall prompts across the supply-chain unit. Answer each in your own words first, then reveal the model answer and compare.
Retrieval beats re-reading. For each prompt, say or write a full answer from memory before you open the model answer — the effort of recall is what makes the material stick.
Reconstruct the unit’s core mechanisms — why the install step is the surface, what lockfiles and hashes do and miss, how confusion works, and what SBOM, provenance, and signing each answer — without looking back at the lesson.
- 01Why is the install step — not your application code — the modern attack surface?
- 02What does a lockfile with integrity hashes protect against, and what does it NOT?
- 03Walk through a dependency-confusion attack and the layered defense.
- 04What is an SBOM, and what question does it answer that a signature or provenance cannot?
- 05Explain SLSA provenance and signed artifacts, and why xz-utils needed exactly this layer.
- 06Order the supply-chain defenses from cheapest/most-immediate to most organizational, and justify the ordering.
If you could reconstruct each answer from memory, you hold the unit’s spine: the install step is the attack surface; lockfiles with hashes and npm ci guarantee you got the exact bytes but say nothing about how they were built; dependency confusion is a resolution-order bug fixed by precedence, not luck; SBOMs answer what is inside; and SLSA provenance plus Sigstore signing answer how it was built and whether it was tampered with — the layer xz needed and lockfiles missed. Now when you encounter a supply-chain incident report, you’ll read straight past the headline to the seam where the attack entered — and reach for the specific control that closes it, not the next one on the list.
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.