The Comforting Lie Of SHA Pinning

Originally published at https://www.vaines.org/posts/2026-03-24-the-comforting-lie-of-sha-pinning/ In March 2026, Trivy became the latest reminder that software supply chains are, at best, loosely held together with convention and trust. A typosquat...