Why Signing Both JAR and Container Image Matters for Pipeline Security

·1 views

A software team building a CI/CD pipeline discovered that signing only the JAR artifact left a critical gap, since the container image — not the JAR — is what actually runs in production. To close this gap, they extended artifact signing to cover the container image as well, making each handoff in the build chain independently verifiable. The signing key is strictly restricted to the pipeline runner's role, ensuring no developer or local build can produce a valid signed artifact. The team consistently rejects requests for manual signing workarounds, arguing that allowing human signatures would reduce every signature's guarantee from 'came from the pipeline' to 'probably came from the pipeline'. Their conclusion is that artifact signing is a narrower security property than often claimed, and its value depends entirely on who can access the signing key and schedule jobs on the build runner.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

XML Namespace Prefix Change by Customs Broker Halted 270 Shipments for Hours

A weekend platform upgrade by a customs broker changed the XML namespace prefix in their export declaration messages from 'cus' to 'ns2', which are technically equivalent but broke a six-year-old reader that matched elements by literal prefix string. On a Monday in October, 270 shipments sat uncleared at the warehouse while the system silently treated unreadable statuses as 'pending', logging no errors and acknowledging all messages normally. The issue went undetected until a warehouse lead called the broker repeatedly and obtained a raw message file, after which engineers patched the reader and replayed archived messages within the same afternoon. The fix replaced prefix-dependent XPath and regex logic with a namespace-aware parser that matches elements by URI and local name, and unreadable statuses now trigger alerts via a rejected queue instead of defaulting to pending. The team also updated contract tests to include messages with varied prefixes and requested advance notice from partners before any future platform changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Warehouse Fixes £400k Stock Error Problem by Treating Short Picks as Live Audits

A UK warehouse operation was losing nearly £400,000 annually in credits and lost orders due to persistent stock discrepancies between its inventory system and physical shelf contents. The system maintained a running balance calculated from scans rather than actual counts, meaning unscanned movements — such as damaged stock disposal or misplaced pallets — were never corrected until the annual stocktake. At the largest depot, one in seven locations held a quantity that differed from the system's recorded figure, with some empty locations generating daily short picks for over a month while replenishment never refilled them. The team redesigned their process so that a short pick now triggers an immediate location hold and a physical count within the hour, with continuous cycle counting prioritising high-risk and fast-moving locations. As a result, short picks have roughly halved and the annual stocktake has been reduced from three days to one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Three Converging Technologies Made AI Voice Agents Sound Human

AI phone agents have become significantly more human-sounding over the past two years, not due to a single breakthrough but because three core components — speech-to-text, language models, and text-to-speech — all matured simultaneously. Each stage must operate in a streaming fashion, overlapping rather than running sequentially, to keep response latency within the 800-millisecond window that human conversation demands. Turn-taking is managed through techniques like semantic endpointing, which judges whether a speaker has finished based on meaning rather than silence alone, and barge-in support that lets callers interrupt the agent naturally. Model selection also involves trade-offs, with many production systems using a smaller, faster model for routine exchanges and routing complex requests to a larger one. Despite major improvements in prosody and naturalness, current systems still struggle with proper nouns, regional place names, and non-English pronunciation, making locale-specific testing essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RAG Architecture Explained: Five Boxes, Six Arrows, and Hidden Costs

A Retrieval-Augmented Generation (RAG) system can be broken down into five core components: an index, a retriever, a reranker, a context builder, and a loop controller. Each connection between these components carries a data payload that incurs costs both when data is moved and when it is processed. The index sets a hard ceiling on system performance, since any fact lost during chunking or indexing cannot be recovered downstream by reranking or prompt engineering. The context builder is the only component that can actively reduce costs within a single request, while the loop controller poses the greatest billing risk because each additional iteration re-runs all upstream components. Engineers are advised to map every data transfer across their stack and price the largest one — the input into the model prompt — to estimate baseline monthly retrieval costs before any optimization.

0 comments Read more at DEV Community