Software supply chain security

Incorrect — dependencies are one link; the chain is broader.

Incorrect — that is delivery, not the build supply chain.

Incorrect — the cluster is the end, not the whole chain.

Incorrect — these attacks are often sophisticated; leverage is the driver.

Incorrect — production is usually the hardened part — the chain is softer.

Incorrect — they can be detected; the appeal is reach.

Incorrect — performance is unrelated.

Incorrect — that is exactly what vuln scanning asks.

Incorrect — size is a hardening concern, not the trust question.

Incorrect — no — the artifact was compromised before it ran.

Incorrect — not the mechanism of these attacks.

Incorrect — the compromise was upstream, in the build/CI.

Incorrect — not how confusion works.

Incorrect — it abuses resolution order, not MITM.

Incorrect — that is a different attack.

Incorrect — the point is the opposite risk.

Incorrect — it misses build/dep/account compromises.

Incorrect — the code genuinely looked fine; the change was elsewhere.

Incorrect — that is the model DevSecOps replaces.

Incorrect — the opposite.

Incorrect — one tool is not the practice.

Incorrect — nothing to do with geography.

Incorrect — that is shifting right — the opposite.

Incorrect — unrelated.

Incorrect — fast is good; friction is the problem.

Incorrect — false positives are the friction, not their absence.

Incorrect — automation (unskippable) is the goal.

Incorrect — visibility is unrelated to integrity.

Incorrect — that removes the checks, not adds them.

Incorrect — unrelated to source integrity.

Incorrect — unrelated to build speed.

Incorrect — that is dependency scanning.

Incorrect — unrelated.

Incorrect — low risk.

Incorrect — important, but not the highest-value target.

Incorrect — not security-critical.

Incorrect — it is about build reproducibility, not runtime.

Incorrect — it records hashes; it does not encrypt.

Incorrect — that is a scan report.

Incorrect — it can update the lockfile and resolve new versions, defeating the pin.

Incorrect — then nothing is pinned.

Incorrect — integrity, not speed, decides here.

Incorrect — that is exactly the mutable reference to avoid.

Incorrect — a name resolves to a mutable tag.

Incorrect — not an image identifier.

Incorrect — version length is irrelevant.

Incorrect — does not stop resolution hijacking.

Incorrect — that weakens integrity.

Incorrect — frozen versions rot into known-vulnerable ones.

Incorrect — that reintroduces the drift risk.

Incorrect — drift makes the eventual update a scary migration.

Incorrect — too slow — the exploit window is days.

Incorrect — a CVE fix is not optional.

Incorrect — deferring a security patch is the risk.

Incorrect — that is scanning; SLSA is about build integrity.

Incorrect — unrelated to speed.

Incorrect — not what SLSA defines.

Incorrect — that would be forgeable — below L2.

Incorrect — L1 already requires provenance to exist.

Incorrect — not how provenance works.

Incorrect — unrelated to speed.

Incorrect — the opposite — that would let a malicious build lie.

Incorrect — higher levels need stronger, non-falsifiable provenance.

Incorrect — that is the anti-pattern hermeticity forbids.

Incorrect — location is not the definition.

Incorrect — unrelated.

Incorrect — reproducible is about output, not speed.

Incorrect — re-running is not the same as identical output.

Incorrect — caching is unrelated to determinism.

Incorrect — stage count is not a security issue.

Incorrect — speed is not integrity.

Incorrect — containers are fine; the fetch is the problem.

Incorrect — that is an untrustworthy builder.

Incorrect — manual is not the trust property.

Incorrect — speed is not trust.

Incorrect — storage is not the point; verification is.

Incorrect — publicity is not verification.

Incorrect — provenance is signed, not encrypted.

Incorrect — the opposite — the builder is not isolated.

Incorrect — isolation is unrelated to reproducibility, and it is missing.

Incorrect — a shared privileged runner is not hermetic.

Incorrect — those are scanning/SBOM tools, not Sigstore.

Incorrect — those are policy engines.

Incorrect — those are delivery tools.

Incorrect — unrelated.

Incorrect — that is scanning.

Incorrect — unrelated to signing.

Incorrect — it logs, it does not encrypt.

Incorrect — that is a registry.

Incorrect — not its function.

Incorrect — that is signing/attestation.

Incorrect — unrelated.

Incorrect — that is Kubernetes YAML.

Incorrect — deleting it removes the value.

Incorrect — a log nobody queries is a checkbox.

Incorrect — secrecy is not the issue; queryability is.

Incorrect — not the point of an SBOM.

Incorrect — the value is operational, not just audit.

Incorrect — signing helps trust; the drill is the query.

Incorrect — an attestation carries a claim (predicate), not only a signature.

Incorrect — no — it is a statement about one.

Incorrect — unrelated.

Incorrect — that is a scan, not provenance.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — a tag is mutable; the developer/build could forge it.

Incorrect — not the trust-establishing binding.

Incorrect — not how provenance is anchored.

Incorrect — that produces evidence; it does not enforce.

Incorrect — signing is evidence; verification enforces.

Incorrect — a doc is not enforcement.

Incorrect — a signature-only check lets an attacker sign their own image.

Incorrect — irrelevant to trust.

Incorrect — not a trust property.

Incorrect — that blocks everything and gets rolled back.

Incorrect — Audit only warns; it never enforces.

Incorrect — exemptions must be explicit and narrow, not a blanket skip.

Incorrect — that is a scanner.

Incorrect — that is Cosign.

Incorrect — unrelated.

Incorrect — you also want shift-left feedback in CI.

Incorrect — CI can be bypassed; admission is the backstop.

Incorrect — it is core enforcement.

Incorrect — they close different holes.

Incorrect — no — one checks the signer, one checks the source.

Incorrect — they complement each other.

Incorrect — unrelated to size.

Incorrect — unrelated.

Incorrect — not the gap.

Incorrect — the opposite of the intent.

Incorrect — signing is still required.

Incorrect — unrelated to runtime.

Incorrect — it widens your attack surface significantly.

Incorrect — an attacker-signed image from their registry still passes a signature-only check.

Incorrect — not the concern.

Incorrect — that is not why it becomes vulnerable.

Incorrect — a digest is immutable.

Incorrect — the point is it was clean at build, then a CVE dropped.

Incorrect — unnecessary — scan the stored SBOM against fresh CVE data.

Incorrect — not scalable for CVE tracking.

Incorrect — logs are not a scannable inventory.

Incorrect — that is Cosign.

Incorrect — that is Syft.

Incorrect — unrelated.

Incorrect — that is not operating security.

Incorrect — suppression needs an auditable VEX reason.

Incorrect — broadcast is not remediation.

Incorrect — the blast radius follows the chain outward.

Incorrect — those are exactly what you must trace.

Incorrect — you must scope and contain immediately.

Incorrect — they do not tell you what was built with the bad component.

Incorrect — guessing is what SBOMs/provenance replace.

Incorrect — irrelevant.

Incorrect — the entry path and exposure remain.

Incorrect — that reruns the compromised artifact.

Incorrect — a build breach may have exposed many; rotate broadly.

Incorrect — those are the leading stage, not the start.

Incorrect — valuable, but it builds on the base.

Incorrect — all-or-nothing is the trap; adopt incrementally.

Incorrect — a doc is not enforcement.

Incorrect — point-in-time is not continuous security.

Incorrect — speed alone is not the security goal.