skills.rest
philo-groves
philo-grovesCOMMUNITY
Explore all skills by this author →
GitHub

maxtac-supply-chain-source-artifact-diff

Compare source code with shipped artifacts to detect tampering or discrepancies.

12|Updated Jun 1, 2026
Search Tags:#security audit#source code analysis#supply chain#artifact integrity#binary comparison
One-click install
npx skills add https://github.com/philo-groves/MaxTAC --skill maxtac-supply-chain-source-artifact-diff
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: maxtac-supply-chain-source-artifact-diff
Source: https://github.com/philo-groves/MaxTAC/tree/main/plugins/maxtac-supply-chains/skills/maxtac-supply-chain-source-artifact-diff
Command: npx skills add https://github.com/philo-groves/MaxTAC --skill maxtac-supply-chain-source-artifact-diff

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires artifact-diff.py, and includes scripts (resource) components.

What problem does it solve?

This Skill is designed to solve the problem of ensuring the integrity of artifacts in the supply chain, comparing source code with shipped artifacts to detect tampering or discrepancies.

Core Features & Use Cases

  • Artifact Integrity Verification: Compares source code with the actual artifact to detect discrepancies.
  • Source-to-Artifact Analysis: Provides detailed comparisons between source code and the artifact, including file changes, permissions, and metadata.
  • Use Case: When conducting a security audit of a software supply chain, this Skill can be used to verify that the binary release matches the source code from which it was built.

Quick Start

Run the 'artifact-diff.py' script to compare two directories or archives.

Frequently Asked Questions about maxtac-supply-chain-source-artifact-diff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I compare source code with shipped artifacts to detect supply chain tampering?▼

To compare source code with shipped artifacts for supply chain security, you analyze file changes, permissions, and metadata discrepancies. This artifact integrity verification process detects tampering by ensuring the binary release perfectly matches its intended source code.

What is source-to-artifact analysis in software supply chain security?▼

Source-to-artifact analysis is a security audit technique that verifies artifact integrity by detecting discrepancies between original source code and shipped binaries. It compares file changes, permissions, and metadata to identify potential supply chain tampering.

Does artifact-diff.py support comparing various package formats?▼

Yes, artifact-diff.py supports comparing various package formats during source code analysis. It operates directly on directories or archives to detect artifact integrity discrepancies, accommodating different packaging conventions in supply chain research.

Can I verify artifact integrity using directories and archives as input?▼

Yes, you can verify artifact integrity by operating directly on directories or archives as input. The comparison process analyzes file changes, permissions, and metadata to detect discrepancies between source code and the shipped artifacts.

What file metadata is checked during a source code and binary comparison?▼

During a source code and binary comparison, the analysis checks file changes, permissions, and metadata. This detects any discrepancies or tampering that may have occurred between building the source code and shipping the artifact.

Related Skills

Explore More Software Engineering Skills→
sidunrealdesidunrealde

cleanup

Archive phase directories from completed milestones into structured archives.

Community
Intermediate
scumunnascumunna
1

discrepancy-and-reconciliation

Reconcile ad impression discrepancies between ad servers and DSPs.

Community
Intermediate
DITEKmaxDITEKmax

cso

Audit repository infrastructure for secrets, CI/CD misconfigurations, and supply-chain risks.

Community
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced