https://linuxeries.org/tags/key-management/ Recent content in Key-Management on ShieldedBytes Hugo en Mon, 09 Nov 2026 09:30:34 +0200 https://linuxeries.org/post/2026-11-09-how-to-spot-and-block-unauthorized-package-si/ Mon, 09 Nov 2026 09:30:34 +0200 https://linuxeries.org/post/2026-11-09-how-to-spot-and-block-unauthorized-package-si/ <h2 id="the-threat-of-rogue-package-signatures">The threat of rogue package signatures</h2> <p>When a CI/CD pipeline pulls a dependency, it assumes the artifact came from a trusted source. In 2025, several high‑profile supply‑chain incidents showed that attackers can replace a legitimate package with a malicious one that carries a valid signature. The signature itself is not the problem; it is the trust anchor that the pipeline uses to verify it. If that anchor is compromised or misconfigured, the entire build chain can be subverted.</p>