Case Studies
Review a compromised package maintainer, a poisoned build runner, a vulnerable component not reachable in production, and a signing key compromise. Scope, contain, communicate, and remediate each.
Required evidence
Submit authorized pipeline configuration, inventory, artifact and provenance identifiers, verification output, injected failure, policy decision, remediation, and residual risk. A green build without trustworthy identity and traceability does not pass.
Oral defense
Trace source to runtime, explain which claim each artifact proves, demonstrate rejection of a substitution, and state the response when trust material is revoked.