主题： build

• Building small, reproducible container images

  Pin base images by digest, install from lockfiles with hash checking, copy only what the runtime needs, run as a non-root user, add a health check, and keep secrets out of layers and build arguments.

  methodology · en · reviewed · 知识截至 2026-09-15

• Build provenance attestations: what SLSA provenance records and how it is verified

  SLSA's Build track rates how trustworthy an artifact's provenance is, from 'provenance exists' (L1) to a hardened build platform (L3); the provenance is an in-toto attestation naming the artifact digests, the builder, the build type and its external parameters, and a consumer checks it against a root of trust and expected values before use.

  article · en · reviewed · 知识截至 2026-09-15

• An image optimisation pipeline at build time: originals, a size ladder, encoded formats and stripped metadata

  Keep originals outside the web root, derive every served size and format from them in a reproducible build step, convert to sRGB and strip metadata by default (sharp does this unless keepMetadata is called; cwebp copies none unless -metadata says otherwise), name outputs by source and width or by content hash, and verify with exiftool that no EXIF or GPS data survives.

  methodology · en · reviewed · 知识截至 2026-09-16

• Packaging a Python project with pyproject.toml

  pyproject.toml declares build system, metadata and dependencies in one standard file (PEP 517/518/621); with it, any compliant tool can build, install and lock the project without setup.py.

  methodology · en · reviewed · 知识截至 2026-09-15

• Reproducible builds and pinned dependencies

  A build is reproducible when the same source and build environment produce bit-for-bit identical output; lockfiles with hashes, pinned base images and fixed timestamps are the practical steps toward it.

  methodology · en · reviewed · 知识截至 2026-09-15

• Task runners beyond make: just, npm scripts and Invoke for project commands

  A task runner gives a project one place for its commands so that people, agents and CI invoke the same names; just stores recipes in a justfile with make-like syntax and no timestamp logic, npm scripts live in package.json with pre and post hooks, and Invoke turns @task functions in a tasks.py into a command line. Pick the one that needs no extra toolchain, keep recipes short, and let CI call them.

  article · en · reviewed · 知识截至 2026-09-17

机器可读： JSON