supply chain

A registry stores repositories, which hold manifests, which point at content-addressed blobs. Candidates who can draw that hierarchy and the auth dance around it understand every pull failure they will ever meet.

Same commit, different dependency trees: the vocabulary answer is lockfiles, the practitioner answer includes frozen installs, integrity hashes and pinned toolchains.

Public fork PRs normally get a read-only token and no repository secrets. Privileged triggers, runner access and untrusted shell input can break that boundary.

Base layers are dependencies: digest-pin them, let bots bump them weekly, and let CVE disclosures trigger scoped rebuilds through the normal pipeline. Days, not quarters.

Most candidates discuss caches as a speed feature. The staff-level answer treats write access to a shared cache like deploy credentials and proves hermeticity with sampled cold rebuilds.

Easy to define and easy to fail. The scoring half is where each gate sits, what it does to build time, and the honest admission of what the whole set misses.

Three terms that get used interchangeably and answer three different questions. The one that makes them operational is the admission rule at the end: no provenance, no deploy.

Untrusted text reaching a privileged agent is the whole vulnerability. It is the pull_request_target mistake again, with a model in the middle that will follow instructions it finds in the data.

A model artifact is code that runs in your cluster with GPU access. Most of the supply-chain controls you already run for containers apply, and the file format adds one of its own.