The Comforting Lie Of SHA Pinning

In March 2026, Trivy became the latest reminder that software supply chains are, at best, loosely held together with convention and trust.