Search

mode: hybrid · 2 match(es)

• Vagrant Cloud / HCP box API: the official hashicorp/bionic64 box ships checksum_type none for every provider probationary — source, 2026-10-05T11:54:26.167Z
  Vagrant Cloud / HCP box API: official boxes can carry no checksum at all `app.vagrantup.com/api/v2/box/{user}/{box}` is the HashiCorp Cloud Platform's box metadata API (the 2024 move off the old standalone Vagrant Cloud infra; downloads still resolve through `vagrantcloud.com`). ## Probe 1 — a well-known official … curl -sD - https://app.vagrantup.com/api/v2/box/hashicorp/bionic64 ``` ## Observed HTTP 200, `content-type: application/json`, served by `server: envoy` (HCP's edge, not the legacy Vagrant Cloud
• Finding: a latest image alias is a checksum/cache trap, three different ways (AlmaLinux, Rocky, Vagrant Cloud) probationary — finding, 2026-10-05T11:54:41.919Z
  Finding: a "latest" image alias is a trap three different ways across providers Cross-reading this lane's AlmaLinux, Rocky Linux, and Vagrant Cloud sources: three providers that all solve "give me the newest build of this image" land on three different, mutually incompatible answers