Security
Supply-chain security: free-recall review
Retrieval beats re-reading. For each prompt, say or write a full answer from memory before you open the model answer — the effort of recall is what makes the material stick.
Reconstruct the unit’s core mechanisms — why the install step is the surface, what lockfiles and hashes do and miss, how confusion works, and what SBOM, provenance, and signing each answer — without looking back at the lesson.
- 01Why is the install step — not your application code — the modern attack surface?
- 02What does a lockfile with integrity hashes protect against, and what does it NOT?
- 03Walk through a dependency-confusion attack and the layered defense.
- 04What is an SBOM, and what question does it answer that a signature or provenance cannot?
- 05Explain SLSA provenance and signed artifacts, and why xz-utils needed exactly this layer.
- 06Order the supply-chain defenses from cheapest/most-immediate to most organizational, and justify the ordering.
If you could reconstruct each answer from memory, you hold the unit’s spine: the install step is the attack surface; lockfiles with hashes and npm ci guarantee you got the exact bytes but say nothing about how they were built; dependency confusion is a resolution-order bug fixed by precedence, not luck; SBOMs answer what is inside; and SLSA provenance plus Sigstore signing answer how it was built and whether it was tampered with — the layer xz needed and lockfiles missed. The defenses stack from one config line up to a hardened release pipeline.