Sourcing Vagrant Boxes Safely: Trust Boundaries, Pinning, and Operational Checks
An architecture note on treating Vagrant boxes as supply-chain artifacts: the three trust boundaries (catalog, box tar, executable Vagrantfile), a minimal pinned-and-checksummed design, and the operational checks that prove it works.