# sha-256 Published articles for sha-256. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Laravel Scalpel Scans for Filesystem Intrusion Evidence DevFeed: [Laravel Scalpel Scans for Filesystem Intrusion Evidence]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-09-17T01:38:29Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [Filesystems](), [Security](), [backdoor](), [PHP]() Tags: [backdoor](), [filesystem](), [laravel](), [laravel-packages](), [php](), [security](), [sha-256]() ### AI overview Laravel Scalpel is an intrusion-evidence scanner that runs inside Laravel applications. It checks filesystems for rogue PHP files, obfuscated code, altered server directives, environment issues, and changes from a trusted baseline. ### Source excerpt Laravel Scalpel scans Laravel filesystems for rogue PHP files, obfuscated backdoors, altered directives, environment issues, and file changes. The post Laravel Scalpel Scans for Filesystem Intrusion Evidence appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Ship agent skills like packages: discovery index, digests, and install sources DevFeed: [Ship agent skills like packages: discovery index, digests, and install sources]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-08-12T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [Agent Skills](), [Agent Skill](), [ai-coding](), [Publishing](), [GitHub](), [make](), [rubygems]() Tags: [agent-experience](), [agent-skill](), [agent-skills](), [ai](), [coding](), [coding-agents](), [dx](), [github](), [jamstack](), [json](), [llms](), [npm](), [rubygems](), [sha-256](), [skills]() ### AI overview This tutorial explains how to publish agent skills so AI coding agents can discover and install them. It covers a .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file, multi-file, and bundle packaging, multiple install commands, and hosting skills from a GitHub repository while re-hosting the served files on the publisher's domain. ### Source excerpt How to publish agent skills so any AI coding agent can find and install them: the .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file vs multi-file vs bundle packaging, and every install command. Worked from the catalog we just open-sourced. ## Install, Launch, Update: Shipping a CLI on Five Platforms -- the devrig Approach DevFeed: [Install, Launch, Update: Shipping a CLI on Five Platforms -- the devrig Approach]() Original publisher: [Read original article]() Author: Eugene Petrenko Published: 2026-08-06T00:00:00Z Content type: tutorial Language: en Sources: [Eugene Petrenko]() Topics: [Command-line interface](), [Kotlin](), [ide]() Tags: [agents](), [ai-agents](), [ai-coding](), [architecture](), [cli](), [command-line](), [devrig](), [distribution](), [eugene-petrenko](), [jdk](), [jonnyzzz](), [jvm](), [kotlin](), [mcp-steroid](), [open-source](), [sha-256](), [tag-41199d53f463]() ### AI overview This tutorial presents the devrig approach to distributing and updating a JVM command-line tool across five platforms. It describes generated install scripts with verified JDK coordinates and baked-in URLs and SHA-256 hashes, content-addressed side-by-side installations, binary-owned launchers, and updates performed by running a fresh install script. ### Source excerpt A JVM command-line tool is easy to write and miserable to ship. You need five platforms, a JDK the user does not have, an update path that never overwrites a running install, and a trust story for a `curl | sh` one-liner. Here is the architecture we ended up with in `devrig`: generate the install script from a model whose JDK coordinates are signature-verified, make installs content-addressed and side-by-side, let the binary own its own launcher, and make "update" mean nothing more than running a fresh install script ## Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads DevFeed: [Node-ipc compromised: Credential stealer targets package with 500k+ weekly downloads]() Original publisher: [Read original article]() Published: 2026-05-14T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [Node.js](), [Security](), [npm](), [Cloud](), [ssh](), [Kubernetes](), [Artificial Intelligence](), [API keys](), [CommonJS](), [Claude](), [Terraform]() Tags: [ai](), [api-keys](), [chainguard-libraries](), [ci-cd](), [claude](), [cloud](), [commonjs](), [dns](), [github](), [kubernetes](), [malware](), [microsoft](), [node](), [node-ipc](), [node-js](), [node-malware](), [node-worm](), [npm](), [npm-malware](), [payload](), [security](), [sha-256](), [shai-hulud](), [ssh](), [terraform]() ### AI overview Three malicious versions of the node-ipc npm package harvested and exfiltrated credentials from cloud providers, SSH, Kubernetes, CI/CD, version-control tools, and AI APIs. The article reports that Chainguard customers were not affected. ### Source excerpt Malicious node-ipc packages stole cloud, SSH, Kubernetes, and AI keys. Chainguard customers stayed protected through source-built libraries. ## Introducing Graph Artifacts: Versioned, Immutable Schemas for Confident Deployments DevFeed: [Introducing Graph Artifacts: Versioned, Immutable Schemas for Confident Deployments]() Original publisher: [Read original article]() Author: David Staheli Published: 2025-10-07T07:00:02Z Content type: release Language: en Sources: [Apollo Blog]() Topics: [GraphOS](), [DevOps](), [releases](), [audit trail]() Tags: [announcement](), [audit-trail](), [devops](), [graphos](), [oci](), [preview](), [releases](), [router](), [sha-256]() ### AI overview Apollo introduces Graph artifacts in Public Preview, providing versioned, immutable schema packages for Apollo Router deployments. Each publish generates an OCI-compliant artifact with a unique SHA-256 digest that teams can pin, roll back, and audit. ### Source excerpt Every DevOps team knows the pain: a schema breaks production, and rolling back means republishing, recomposing, and crossing your fingers. Graph artifacts change that--giving you versioned, immutable schemas you can deploy, roll back, and audit with confidence. DevOps best practices have given engineering teams confidence in how they ship software--except when it comes to supergraph schemas. ## Chainguard's image tagging philosophy: enabling high velocity updates (pt. 2 of 3) DevFeed: [Chainguard's image tagging philosophy: enabling high velocity updates (pt. 2 of 3)]() Original publisher: [Read original article]() Published: 2023-11-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [chainguard](), [container](), [Git]() Tags: [chainguard](), [container](), [container-images](), [content-addressed-tagging](), [digests](), [git](), [git-tags](), [image-tagging](), [immutable-tags](), [sha-256]() ### AI overview Part 2 of a three-part series explains Chainguard's content-addressed image tagging philosophy. It argues that image digests provide a concise canonical identifier because they incorporate the contents and metadata of the entire container image, and compares them with Git commit SHAs. ### Source excerpt Dive deeper into Chainguard's approach to image tagging, a cornerstone for swift and efficient container updates in Part 2 of this series. ## New Chainguard Academy tutorial: Cosign the manual way DevFeed: [New Chainguard Academy tutorial: Cosign the manual way]() Original publisher: [Read original article]() Published: 2023-03-30T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Tutorial](), [sigstore](), [Security](), [supply-chain-security](), [Command-line interface](), [Software]() Tags: [algorithm](), [chainguard](), [chainguard-academy](), [cli](), [cosign](), [rekor](), [rsa](), [security](), [sha-256](), [signing](), [sigstore](), [software-artifact-signing](), [transparency-log](), [trust](), [tutorial](), [verify]() ### AI overview This article introduces a Chainguard Academy tutorial that explains Cosign's blob-signing capabilities. It covers generating an RSA key pair, signing data with SHA-256, uploading signatures to the Rekor transparency log, and verifying the signature. ### Source excerpt New Chainguard Academy tutorial unpacks Cosign the manual way and explores Cosign's blob signing capabilities. ## Ultimate Go: Advanced Engineering Episode 2 DevFeed: [Ultimate Go: Advanced Engineering Episode 2]() Original publisher: [Read original article]() Published: 2022-12-13T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Dependency management](), [Blockchain](), [Algorithm](), [Command-line interface](), [Database]() Tags: [algorithm](), [blockchain](), [cli](), [database](), [dependency-management](), [go](), [go-blockchain](), [golang-blockchain](), [hash-algorithms](), [hash-collision](), [hashing](), [sha-256](), [sha256]() ### AI overview This video tutorial explains how dependency management in Go relates to reproducible builds, blockchain hashing, and trust in a centralized dependency database. It introduces hashes as distributed identifiers, explains collisions, and discusses the use of SHA-256 to reduce collision risk. ### Source excerpt Introduction In episode 1, Bill finished by describing the dependency management conundrum Go faced in its early days. Prior to the Go team providing the module system, developers were on their own to find a solution. Engineers in the Go community did propose different solutions, but there was no general consensus on which tool to use for dependency management. In this video, Bill will begin to architect a solution to the reproducible build problem. By doing so, you will learn how blockchain hashing works and then Bill will share how centralizing this dependency database will cause other problems. One of these problems is people eventually losing trust in the database because only one stakeholder, Bill, can make changes to it without a means for users to detect the change. He closes this segment with an important question, "how do we establish trust for this CLI's database?" ## Thought experiment on protocols and noise DevFeed: [Thought experiment on protocols and noise]() Original publisher: [Read original article]() Author: Nate Lawson Published: 2014-11-04T18:42:52Z Content type: opinion Language: en Sources: [rdist]() Topics: [Security](), [Protocol (disambiguation)](), [sha-256](), [hash]() Tags: [crypto](), [hash](), [hmac](), [network](), [protocol](), [protocols](), [security](), [sha-256]() ### AI overview A security thought experiment examines how to respond when an HMAC does not verify, including whether comparing MAC differences could distinguish network noise from tampering. It questions the security risks of exposing error details or accepting messages with altered MAC bits. ### Source excerpt I hesitate to call this an interview question because I don't think on-the-spot puzzle solving equates to a good engineering hire. On the other hand, I try to explore some simple thought experiments with candidates that have a security background. One of these involves a protocol that has messages authenticated by an HMAC. There's a message ... Continue reading Thought experiment on protocols and noise