Supply-Chain
guest@6admin.io:~$ ls ~/tags/supply-chain
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
Ansible CI Toolkit v1: the year I stopped trusting my own image
The hardened sequel: ansible and ansible-lint merged into one image, Kerberos/WinRM for Windows targets, non-root, base pinned by digest, a pip constraints lock, transitive Galaxy pins and cosign signing. Built by a CHANGELOG that reads like a CVE diary.
Trivy, the scanner that was stealing secrets
On March 19, 2026, the tool meant to protect the supply chain became its vector. The lesson fits in one sentence: a tag is not a trust reference.
When a Chocolatey checksum breaks a whole provisioning run
A Chocolatey Community package whose vendor updated the binary without the maintainer updating the checksum and the whole Windows provisioning stops. The real subject is not the hash, it is depending on a binary you do not host.