This Shit is Hard: Building forkstore

The This Shit is Hard series has spent a lot of time on how we make patches: backporting disclosed CVE fixes in Chainguard Libraries, authoring fixes for zero-days that have no upstream patch at all, and running all of it inside a sandbox. This post is about a problem that sits underneath all of it: once you've made those patches, where do they live? Chainguard Libraries rebuilds open source packages with fixes for publicly disclosed CVEs, ordinary backports of vulnerabilities the whole world already knows about. Athena adds a second, very different stream. Coalition members share zero-day vulnerabilities that haven't been disclosed yet. Chainguard remediates those vulnerabilities, and we deliver those fixes to members under embargo, usually 30 days, before the vulnerability becomes public. Those two streams can't be kept in separate corners, because they impact the same packages with different confidentiality rules. Take a customer…