Polyfill supply chain attack hits 100K+ sites

Re:Polyfill supply chain attack hits 100K+ sites by ryan29 on Tuesday June 25, 2024 @03:30PM (#40792601)

The same concept should be applied to container based build pipelines too. Instead of pulling dependencies from a CDN or a pull through cache, build them into a container and use that until you're ready to upgrade dependencies.

It's harder, but creates a clear boundary for updating dependencies. It also makes builds faster and makes old builds more reproducible since building an old version of your code becomes as simple as using the builder image from that point in time.

Here's a nice example [1] using Java.

1. https://phauer.com/2019/no-fat-jar-in-docker-image/

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by hinkley on Tuesday June 25, 2024 @04:15PM (#40793074)

I get the impression this is a goal of Nix, but I haven't quite digested how their stuff works yet.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by gopher_space on Tuesday June 25, 2024 @05:29PM (#40793858)

> The same concept should be applied to container based build pipelines too. Instead of pulling dependencies from a CDN or a pull through cache, build them into a container and use that until you're ready to upgrade dependencies.

Everything around your container wants to automatically update itself as well, and some of the changelogs are half emoji.

[ Parent | on HN ]