[Verse 1] In the beginning there's a source repo clean Where developers write what they want code to mean But building that code takes a different place With compilers and tools in a separate space And what gets released to the world out there Is an artifact living with its own set of cares [Chorus] Three things apart, three things to guard Source and build and artifact Security gaps when they're not aligned Supply chain breaks when trust is blind From code to binary, mind the seams Nothing is quite the way it seems [Verse 2] The source might be perfect, reviewed line by line But the build server could be compromised this time Injecting malicious bits into your clean code While the artifact carries what you never wrote Or maybe the source has a backdoor hidden deep That only appears when the build system sleeps [Chorus] Three things apart, three things to guard Source and build and artifact Security gaps when they're not aligned Supply chain breaks when trust is blind From code to binary, mind the seams Nothing is quite the way it seems [Bridge] Reproducible builds can help close the gap When the same source creates the same artifact map But environments drift and dependencies change Making identical outputs incredibly strange Hash verification and signed attestations Help prove the lineage through transformations [Verse 3] An attacker who owns just one of the three Can poison your pipeline quite easily Swap the artifact while keeping source the same Or modify builds while playing the blame game That's why provenance tracking matters so much From initial commit to production's first touch [Chorus] Three things apart, three things to guard Source and build and artifact Security gaps when they're not aligned Supply chain breaks when trust is blind From code to binary, mind the seams Nothing is quite the way it seems [Outro] Trust but verify every single stage From repository to the deployment page The separation creates the risk we face But knowing the gaps helps secure the space
← Language Ecosystems: Package Managers Across the Stack | The Reproducibility Problem: Same Code, Different Results →