Engineering / advanced
Verifiable software supply chains
Connect dependencies, build isolation, artifact identities, attestations, and admission decisions into a verifiable path from source to execution.
Your route through engineering
Follow the path or begin with a question. Every lesson is open.
Your place, at your pace. Progress is optional and saved only in this browser when available.
Read / explore / reason
Inside this module
Module 01 advanced
Verifiable software supply chains
Connect dependencies, build isolation, artifact identities, attestations, and admission decisions into a verifiable path from source to execution.
- 01
Lock a resolved dependency graph without confusing it with trust
Distinguish version constraints, concrete resolution, artifact integrity, and availability when assembling AI software environments.
24 min - 02
Use dependency risk arithmetic without inventing independence
Compare union bounds and independent-event models while preserving shared identities, common causes, and execution context.
24 min - 03
Close the build over declared inputs
Expose tools, environment, network responses, and AI assets that can change output while keeping isolation and correctness claims distinct.
24 min - 04
Compare rebuilt bytes and explain every difference
Use defined artifact scope and independent reconstruction to investigate reproducibility without mistaking identical output for safe behavior.
24 min - 05
Bind an inventory to its actual artifact and scope
Read versioned SBOM formats as structured inventory evidence while examining collection scope, component identity, and unknown coverage.
24 min - 06
Verify content identities through the image graph
Follow trusted OCI descriptors from an approved root to retrieved image bytes while separating content integrity, registry access, and release authorization.
24 min - 07
Verify who signed what under an explicit trust policy
Bind signatures to artifact identities, approved signers, trustworthy time evidence, and versioned roots without treating a valid signature as harmless code.
24 min - 08
Check what a builder actually attests about an artifact
Bind versioned provenance claims to their subject, predicate semantics, and trusted builder instead of treating signed metadata as an automatic security verdict.
24 min - 09
Turn verified claims into a consistent admission decision
Apply explicit artifact, identity, provenance, and failure rules at the execution boundary while preserving the approved identity through retrieval.
24 min - 10
Rebuild trust after a builder compromise
Scope affected artifacts, separate credential containment from artifact revocation, and reconstruct approved releases without trusting the compromised production path.
24 min