Now, you’re reading this and you’re probably asking yourself, why? As Simon Sinek once said, start with why: why, why, why does this guy always talk to us without talking to us. Why, why, why.

Well, I’ll tell you why. Because I am talking to you. More precisely, I’m talking to your heart, which is exactly the title of a song by our national hero Charly García, released in “Tango” on March 29th, 1986, that is, a bit over 40 years ago, and I’ll leave it up to you to Google Translate the lyrics, which are sublime.

Oh yeah, it does sound 1980s, huh? Those synths. THOSE SYNTHESIZERS.

Charly, being the superstar he still is (regardless of his substance abuse) has had his own MTV Unplugged album in the 1990s, because it was such a tradition, and within that Unplugged album there’s another song I deeply love, (originally released together in the same album “Tango”), and that other incredible song is called “Pasajera en Trance”, and here it goes again because reasons. It speaks of distance, flow, travel, and so many other things.

“She dances on the sea”, says Charly.

OK, here go the lyrics, because they are out-of-this-world. Enjoy.

She’s about to board,
maybe she’ll snag a seat on the deck.
She’s about to take off,
she’s leaving.
She travels without paying,
the old trick of walking in the shadows.
She dances on the sea,
she’s leaving.
Passenger in a trance,
passenger in perpetual transit.
Passenger in a trance,
passing through the right places.
True love,
is like sleeping and being awake.
True love,
is like living in an airport.

As Charly says at the end, “merci beaucoup”.

Background

The original source code of the Java applet came from the Internet Archive. This original NeXTClock applet was written by Rene K. Mueller and is preserved in original/NeXTClock.java in the GitLab project. That applet used AWT, a background GIF, and a thread that updated the displayed time. I used that Java applet in my “GaMMA” home page around 1999, until 2004.

Interestingly enough, the original Java version was written almost exactly 30 years ago at the time of this article:

// --- NeXTClock, written by Rene K. Mueller <kiwi@the-labs.com>
//     V0.20: Jul 20, 1996

import java.awt.Graphics;
import java.awt.Image;
import java.awt.Color;
import java.awt.Font;
import java.awt.FontMetrics;
import java.util.Date;

public class NeXTClock extends java.applet.Applet
        implements Runnable {
// ...

The translated source code in JavaScript in src/NeXTClock.js keeps the same 64 x 64 layout and the same visual idea: a NeXT-like clock tile with the weekday, day of the month, month, green seven-segment time, and blinking separator pixels. The drawing code scales that original layout to fit larger square canvases while preserving the pixelated look.

Usage

Include NeXTClock.js, add a <CANVAS> object on your page, then create and start a clock:

<script src="NeXTClock.js"></script>
<canvas id="clock" width="128" height="128"></canvas>
<script>
  const canvas = document.getElementById("clock");
  const clock = new NeXTClock(canvas, {
    size: 128,
  });

  clock.start();
</script>

The constructor expects an HTMLCanvasElement. By default, it uses the canvas display size and keeps it square. You can also pass a size option or call setSize() later; requested sizes are rounded and clamped between 64 and 500 pixels.

Available methods on the class:

• start() begins animation using requestAnimationFrame().
• stop() cancels the animation frame loop.
• draw(date) draws one frame for the supplied Date, or the current local time when omitted.
• setSize(size) updates the square canvas size and redraws the clock.

You can pass the following options to the constructor:

• backgroundSrc: optional path to a background image. When omitted, the built-in canvas background is used.
• darkGreen: color used for the seven-segment time display. Defaults to #00c800.
• size: optional square canvas size in pixels, clamped from 64 to 500.

The clock automatically observes canvas resizing when ResizeObserver is available, so CSS-driven size changes are reflected in the next rendered frame.

As usual, you can grab the source code on my GitLab account.

The same way I don’t have a Twitter account anymore, or I don’t own (nor plan to buy) a Tesla, I prefer not to associate myself with certain billionaires out there. Personal choice.

There are several competitors of Cursor I’ll be checking in the next few weeks for my personal use (the market of AI-enhanced coding tools is quite booming at the moment), among which I’ll consider (in alphabetical order):

• Anthropic Claude Code
• Emergent
• Google Antigravity 2.0
• JetBrains Junie
• OpenAI Codex
• Replit

And I’ll give a second shot to GitHub Copilot, which I had tried in early 2023 but without good results.

Yes, I have read Miran Lipovača’s masterpiece but, like, 15 years ago, and to be honest I never quite got into using Haskell beyond small experiments. So what’s a (lazy) developer to do in 2026? You guessed it. Particularly after writing a whole issue of De Programmatica Ipsum dedicated to the subject of Functional Programming, including an article about Philip Wadler, one of the fathers of the language.

And once again, just like every time I use Cursor, I just let it do its thing after a good long prompt… and the magic operated in an uncanny way. The translation worked at first try, and I have nothing else to say at this point.

I do not know if you’re fluent in Haskell, but this is the code I got at the end.

#!/usr/bin/env runghc

import Conway.Coord (Coord (..))
import Conway.World (World, beacon, blinker, block, evolve, glider, newWorld, tub)
import Control.Concurrent (ThreadId, myThreadId, threadDelay)
import Control.Exception (AsyncException (UserInterrupt), catch, throwIO, throwTo)
import System.Exit (exitSuccess)
import System.Posix.Signals (Handler (Catch), installHandler, sigINT)
import System.Process (callCommand)

clearScreen :: IO ()
clearScreen = callCommand "clear"

handleSigInt :: ThreadId -> IO ()
handleSigInt mainThreadId = throwTo mainThreadId UserInterrupt

nextWorld :: Int -> World -> IO ()
nextWorld generation world = do
  clearScreen
  let currentGeneration = generation + 1
  putStr (show world)
  putStrLn ("Generation " ++ show currentGeneration)
  threadDelay 500000
  nextWorld currentGeneration (evolve world)

main :: IO ()
main = do
  mainThreadId <- myThreadId
  _ <- installHandler sigINT (Catch (handleSigInt mainThreadId)) Nothing
  let aliveCells =
        blinker (Coord 0 1)
          ++ beacon (Coord 10 10)
          ++ glider (Coord 4 5)
          ++ block (Coord 1 10)
          ++ block (Coord 18 3)
          ++ tub (Coord 6 1)
      world = newWorld 30 aliveCells
  nextWorld 0 world `catch` handleUserInterrupt

handleUserInterrupt :: AsyncException -> IO ()
handleUserInterrupt UserInterrupt = do
  clearScreen
  exitSuccess
handleUserInterrupt exception = throwIO exception

The final result shares quite a few similarities with F#; it’s easy to see that there’s a lot of inspiration from Haskell in F#, with the obvious exceptions of .NET-specific features like attributes and such.

open System
open System.Threading
open ConwayLib
open Coord
open World

[<EntryPoint>]
let main argv =
    Console.CancelKeyPress.Add (fun arg ->
        Console.Clear()
        Environment.Exit(0))

    let blinker = blinker { X = 0; Y = 1 }
    let beacon = beacon { X = 10; Y = 10 }
    let glider = glider { X = 4; Y = 5 }
    let block1 = block { X = 1; Y = 10 }
    let block2 = block { X = 18; Y = 3 }
    let tub = tub { X = 6; Y = 1 }
    let aliveCells = blinker @ beacon @ glider @ block1 @ block2 @ tub

    let rec iterate world generation =
        Console.Clear()
        printfn "%s" (worldDescription world)
        printfn "Generation %d" (generation)
        Thread.Sleep(500)
        iterate (evolve world) (generation + 1)

    iterate (createWorld 30 aliveCells) 1

    // return an integer exit code
    0

This similarity is no coincidence. Don Syme, designer and architect of the F# programming language at Microsoft, acknowledged this legacy in his paper “The early history of F#” submitted for HOPL IV in 2020.

The history of the F# programming language is an arc drawn from the 1970s to the present day. Somewhere, back in the early 1970s, an idea was born in the mind of Robin Milner and his colleagues Lockwood Morris and Malcolm Newey of a succinct, fully type-inferred functional programming language suitable for manipulating structured information [Gordon 2000]. Building on the tradition of LISP (and indeed using LISP as their implementation vehicle), this language became ML Meta Language and is the root of a tradition of strongly typed functional programming languages that includes Edinburgh ML, Miranda, Haskell, Standard ML, OCaml, Elm, ReasonML and PureScript. F# is part of this family.
(…)
Initially, in late 2000, in conjunction with Reuben Thomas, I attempted an implementation of Haskell for .NET, using a direct translation from the Core intermediate representation of the Glasgow Haskell Compiler (GHC) to the .NET bytecode. This experience was partly successful: small programs ran. However, the advice of Simon Peyton Jones led me to believe that Haskell.NET couldn’t be successful for several technical and cultural reasons: (…)

In case you don’t know (which given my audience, I’d be surprised to hear) Neovim is a successor of Vim, built since 2014 on a fork of version 7 point something of Vim.

The good news is that it is almost 100% compatible with Vim, and that means I could reuse my good old .vimrc, using the following initialization file in ~/.config/nvim/init.vim

set runtimepath^=~/.vim runtimepath+=~/.vim/after
let &packpath = &runtimepath
source ~/.vimrc

And that’s it. The only line in my .vimrc that didn’t work in Neovim was the following:

set guitablabel=%t

Which to be honest, I don’t remember why it was there.

Most of the Vim plugins I had installed with Pathogen worked off-the-box, with the exception of Gundo, which had trouble accessing my Python environment; so I had to install a separate Python package for that:

$ pip3 install --user --upgrade pynvim

In my Fedora 44, I also installed the neovim-qt package, which provides a similar experience to Gvim on my desktop; this app uses its own configuration file, ~/.config/nvim/ginit.vim, which in my case ended up looking like this:

" Define your default font name and size
let s:default_fontsize = 15
let s:current_fontsize = s:default_fontsize
let s:font_name = "BlexMono Nerd Font"

function! AdjustFontSize(amount)
  let s:current_fontsize = s:current_fontsize + a:amount
  execute "GuiFont! " . s:font_name . ":h" . s:current_fontsize
endfunction

function! ResetFontSize()
  let s:current_fontsize = s:default_fontsize
  execute "GuiFont! " . s:font_name . ":h" . s:current_fontsize
endfunction

" Mappings for Increasing Size (Ctrl + Plus / Ctrl + Equals)
nnoremap <C-+> :call AdjustFontSize(1)<CR>
nnoremap <C-=> :call AdjustFontSize(1)<CR>
nnoremap <C-kPlus> :call AdjustFontSize(1)<CR>

" Mappings for Decreasing Size (Ctrl + Minus)
nnoremap <C--> :call AdjustFontSize(-1)<CR>
nnoremap <C-kMinus> :call AdjustFontSize(-1)<CR>

" Mapping for Reset (Ctrl + Zero)
nnoremap <C-0> :call ResetFontSize()<CR>
nnoremap <C-k0> :call ResetFontSize()<CR>

" Toggle Fullscreen with F11
let s:my_fs_state = 0

function! ToggleFullScreen()
    if s:my_fs_state == 0
        call GuiWindowFullScreen(1)
        let s:my_fs_state = 1
    else
        call GuiWindowFullScreen(0)
        let s:my_fs_state = 0
    endif
endfunction
nnoremap <silent> <F11> :call ToggleFullScreen()<CR>

" Enable standard GUI clipboard shortcuts
nnoremap <C-S-v> "+p
vnoremap <C-S-v> "+p
inoremap <C-S-v> <C-r>+
cnoremap <C-S-v> <C-r>+

call ResetFontSize()

Neovim feels nice, snappy, fast, very convenient, and with a much more interesting roadmap ahead.

I’ve been listening to it in a loop for the last few days. It’s like having a streaming service of sunny weather in your ears. I thought you could use some sun, too. It struck a chord in me. It made me feel good. It made me smile. I felt thankful.

Here goes a good translation of the lyrics in English via some IA over there:

(Let it go)
Let go of that low mood
Raise your head and face evil
Acting this way will be vital for your heart
Because in every experience you learn a lesson
I’ve already suffered for loving like this
I dedicated myself but it was all in vain

(Why?)
Why lament?
If in your life you can find
Someone who loves you with all their strength and passion
Then the pain will subside

(You have to fight)
You have to fight
Don’t get discouraged
Just give yourself
To someone who deserves you
I’m not giving or selling
As the saying goes
My advice is to see you happy

(repeat)

Lala-laia
Lala-laia laia, lala-laia laia, lala-laia, laia-laia-laia
I’m not giving or selling
As the saying goes
My advice is to see you happy
My advice is to see you happy
My advice is to see you happy

I’ve never learned Portuguese, so it’s uncanny how much I could understand (70%, easily) of the lyrics just on the first try. The original goes below, just for the sake of beauty. Brazilian Portuguese is such a beautifully sounding language, it’s almost obscene.

(Deixe de lado)
Deixe de lado esse baixo astral
Ergua a cabeça enfrente o mal
Agindo assim será vital para o seu coração
É que em cada experiência se aprende uma lição
Eu já sofri por amar assim
Me dediquei mas foi tudo em vão

(Pra que?)
Pra que se lamentar?
Se em sua vida pode encontrar
Quem te ame com toda força e ardor
Assim sucumbirá a dor

(Tem que lutar)
Tem que lutar
Não se abater
Só se entregar
A quem te merecer
Não estou dando nem vendendo
Como o ditado diz
O meu conselho é pra te ver feliz

(…)

Lala-laia
Lala-laia laia, lala-laia laia, lala-laia, laia-laia-laia
Não estou dando e nem vendendo
Como o ditado diz
O meu conselho é pra te ver feliz
O meu conselho é pra te ver feliz
O meu conselho é pra te ver feliz

Talk presented at the 2026 Red Hat Summit Connect Switzerland event on January 14th, 2026.

Introduction

Welcome to this presentation titled “What’s in your Container? Securing the Supply Chain without Slowing Down”. This talk was first presented at the 2026 Red Hat Summit Connect Switzerland event in January 14th, 2026.

My name is Adrian Kosmaczewski, and I am a Senior Architect at Red Hat Switzerland.

The “Black Box” Problem

Let us talk about the “Black Box” problem.

Imagine, for a moment, that you walk into a grocery store to buy a frozen lasagna for your family dinner. You pick up the box from the freezer aisle. You toss it in your cart. You trust it. You assume the meat isn’t spoiled. You assume the factory where it was made followed strict health codes.

You assume that the list of ingredients printed on the back (flour, tomatoes, beef, etc.) is actually what is inside the box. You trust the supply chain implicitly because there are regulations and checks in place to keep you safe.

Now, let’s pivot and look at how we build software today.

Modern software development has fundamentally changed. We don’t really “write” code from scratch anymore; we assemble it. We are manufacturing applications on an industrial scale. We take a database from here, a web framework from there, an authentication library from somewhere else, and we glue it all together with a thin layer of our own business logic.

The data backs this up. According to the latest “Open Source Security and Risk Analysis Report” by Synopsys, 96% of all commercial codebases contain open source components. Furthermore, 84% of those codebases contain at least one known vulnerability. We aren’t just using a little bit of open source; our applications are essentially composed of it.

This is fantastic for speed. It allows us to innovate at a pace that was impossible ten years ago. It’s why startups can disrupt giants. But it is absolutely terrifying for security.

Because right now, for most companies, that “frozen lasagna” of software has no ingredients list. It has no seal of authenticity. We are effectively taking binary blobs from the internet (from strangers we have never met, using handles we don’t recognize) and running them in the heart of our sovereign infrastructure. We are downloading packages from NPM, or PyPi, or Docker Hub, often without a second thought.

Consider the phenomenon of “Typosquatting.” An attacker notices that your developers use a popular python library called requests. So, the attacker uploads a malicious library called requessts (with an extra “s”) containing malware. One tired developer makes one typo in a configuration file, and suddenly, you have just invited a trojan horse into your production environment.

We have seen exactly what happens when this goes wrong. We all remember the absolute chaos of Log4j. It wasn’t just a bug; it was a systemic failure. It was a tiny logging library, maintained by volunteers, buried five layers deep in the dependency tree of almost every enterprise Java application in the world. When the vulnerability broke, Chief Security Officers didn’t even know if they were affected or not! They had to scan thousands of servers manually because they didn’t have an inventory.

And let’s not forget SolarWinds. That was a pivotal moment. The attackers realized they don’t need to spend months trying to break into your firewall if they can just poison the water supply. They didn’t attack the customers directly; they injected malicious code into the build system of the vendor. They compromised the factory so that every product leaving the assembly line was pre-infected.

The question we need to answer today is simple, but it is deeply uncomfortable for most IT leaders: Do you actually know what is running in your cluster right now?

Not what you think is running. Not what the architecture diagram says should be running. But what is actually there? And if you don’t know the answer to that question, how can you claim your infrastructure is sovereign? How can you claim you are compliant with upcoming regulations like the EU Cyber Resilience Act, NIS2, or DORA? These regulations are no longer suggestions; they are mandates that will hold boards of directors personally accountable for the hygiene of their digital supply chain.

We need a better way. We need the digital equivalent of a nutrition label, and we need a tamper-proof seal for every single digital artifact we deploy.

The Three Pillars

So, how do we fix this? How do we secure this massive, complex supply chain without slowing our developers down to a crawl? We cannot ask them to manually audit every line of code in every library they use. That is humanly impossible. If we add too much friction, they will just find ways around it, and we end up with Shadow IT, which is even worse.

The solution lies in automation, built on three pillars that are redefining the industry, well known since the times of the Roman Empire: Transparentia, Identitas, et Claustra.

Or in English, Transparency, Identity, and Guardrails.

Transparency

The first pillar is Transparency. In the physical manufacturing world, every part has a serial number. If a specific airbag in a car is found to be defective, the manufacturer knows exactly which cars have it and where they are.

In software, we call this an SBOM…

…also known as a Software Bill of Materials.

This is your ingredients list. It is a machine-readable inventory (usually in formats like SPDX or CycloneDX) that lists every single library, every dependency, and every version number inside your application.

Using open source tools like Syft,…

…or enterprise platforms like Red Hat Trusted Profile Analyzer, we can generate this list automatically every time we build an app. It digs deep (not just listing the top-level libraries you installed, but the transitive dependencies, that is, the libraries that those libraries installed).

What does a SBOM look like? Here’s a fragment of one, showing a dependency on a library available via Maven.

Why does this matter? Imagine the next “Log4j” hits tomorrow morning at 9:00 AM. In the old world, you would spend weeks scanning networks, waking up developers, and panicking. In the new world, you simply query your database of SBOMs. You ask: “Show me every container running Log4j version 2.14.” You get the answer in seconds. You know exactly where the risk is, and you can surgically remove it. That is the power of transparency.

Identity

The second pillar is Identity.

Because knowing the ingredients is good, but knowing who cooked the meal is better. We need to cryptographically sign our code to prove its origin.

Now, I see some of you wincing. I know the history here. Traditionally, code signing has been a nightmare. It usually involves managing private GPG keys that sit on developer laptops.

This approach has two fatal flaws:

First, the “Bus Factor”: If the developer leaves the company, does the key go with them?

Second, Key Hygiene: People lose keys, they leak keys to GitHub by accident, or they just turn the verification off because it breaks their workflow.

You can see the issue here. There’s even an engineer with a third leg in there and another with a third arm holding a diskette. Clearly, not very DevSecOps.

This is where the future is changing. We are seeing a revolution with a project called Sigstore…

…which powers the Red Hat Trusted Artifact Signer.

Sigstore does for code signing what “Let’s Encrypt” did for HTTPS. It makes it free, easy, and automated. It uses a concept called keyless signing.

Think of it like a hotel key card. When you check into a hotel, you don’t get a metal key that you keep forever. You get a plastic card that works for your room, for exactly three days. If you lose it after three days, it doesn’t matter. It’s useless.

Here is how Sigstore works: Your developers don’t generate permanent private keys anymore. Instead, they sign their code using their corporate identity (their Google, Microsoft, or Red Hat login) via OpenID Connect. They prove who they are, and the system issues a short-lived, ephemeral certificate that exists just long enough to sign the code (maybe just ten minutes) and then disappears.

This event is recorded in a tamper-proof transparency log called Rekor. It provides a public, verifiable record that says, “Yes, this specific developer signed this specific piece of code at this specific time.” It removes the burden of key management. It turns signing from a chore into an invisible automated step.

Guardrails

The third pillar is Guardrails.

This is the “Bouncer” at the door. It doesn’t matter if you have a perfect SBOM and a valid signature if nobody checks them before the application goes live. If the bouncer is asleep, the club isn’t safe.

We need an admission controller in our Kubernetes clusters. We use tools like Red Hat Advanced Cluster Security (or ACS) which integrates deeply with Kubernetes admission contexts.

ACS acts as a policy engine. It sits at the API gate of your OpenShift cluster. When a deployment tries to enter, ACS stops it and asks for ID. It checks the signature. It parses the attestation.

It runs a logic check against your specific rules. For example:

Rule 1: “Was this image built on a developer’s laptop?”

Deployment Denied.

Rule 2: “Container signed with the key of another department?”

Deployment Denied.

Rule 3: “Was this image built and signed by our Trusted Pipeline?”

Yes. Access Granted.

This is the fundamental shift in our security posture. We stop relying on hope. We stop relying on manual spreadsheets or quarterly audits. We start relying on cryptographic proof and automated policy enforcement.

We move from “Trust but Verify” to “Verify, then Trust.” We make the cluster itself smart enough to reject the bad stuff.

So, as a recap, remember the three pillars: Transparency, Identity, and Guardrails.

The Architecture of the Factory Floor

So how does this look like in real life?

Let’s visualize how this looks in a real production environment. I want you to think of this as a high-security, automated factory floor.

It starts with the Developer. They are writing code, perhaps using an IDE plugin, and they push their changes to Git. That is the last human interaction in the process. From this moment on, the robots take over to ensure consistency and security.

This git push triggers our factory engine: Red Hat OpenShift Pipelines, based on Tekton.

Tekton spins up a pod to handle the build. But it doesn’t just compile the code. It acts as an observer, a notary, and a security guard all wrapped in one.

Verification: It runs unit tests to ensure functionality.

Scanning: It scans the code for known vulnerabilities using scanners like Clair or Roxctl. If it finds a “Critical” CVE, the line stops right there. The build fails. The developer gets feedback immediately, not three weeks later.

Documentation: It generates that SBOM, creating the “Nutrition Label” for the software.

Sealing: Finally, it uses the Trusted Artifact Signer to cryptographically sign the container image. It stamps the software with a digital seal that says: “This software was built by this sanctioned pipeline, at this time, and it has not been altered since.”

Once the image is signed and sealed, it moves to the warehouse. In our case, this is Red Hat Quay, an enterprise registry.

Quay isn’t just a dumb storage bucket; it understands these signatures and attachments. It keeps the image and its “paperwork” (the SBOM and signatures) together.

Quay also performs “Time Machine” scanning. Just because an image was safe yesterday doesn’t mean it’s safe today. New vulnerabilities are discovered every hour. If Quay detects that a stored image has become vulnerable overnight, it can tag it as unsafe and prevent it from being pulled.

Now, we have a signed, sealed package sitting in the warehouse. How do we get it to the customers? We use GitOps.

We use OpenShift GitOps, based on the Argo CD project. Argo is the delivery truck. It monitors the warehouse. When it sees a new, valid image is available, or when the git configuration changes, it reaches out to pull that image into the production cluster.

Crucially, Argo CD also handles Drift Detection. If a cowboy administrator SSHs into a server and manually changes a configuration, Argo notices the difference between the “desired state” (Git) and the “actual state” (Cluster). It will automatically overwrite the manual change, healing the system back to its trusted state.

But remember the bouncer we talked about?

As Argo tries to apply this update to the cluster, the OpenShift API pauses. The admission controller steps in. It verifies the signature against the public transparency log. It confirms the “Chain of Custody.”

It asks: “Did this come from our factory? Does the signature match the public key we trust?”

Because the signature matches your organization’s trust policy, the gate opens, and the workload starts.

Conversely, if a developer tries to bypass this process (if they try to manually use kubectl or oc to deploy an unsigned container from their laptop, or if a hacker compromises a credential and tries to inject a rogue container) the cluster will reject it immediately. The admission controller will see there is no signature, or the wrong signature, and it will block the request before the container even pulls.

This entire process happens in minutes. The developer didn’t have to run a security scan manually. They didn’t have to manage a private key. They didn’t have to open a ticket for a security review. They just pushed code. The platform (the Golden Path) handled the sovereignty, the compliance, and the security automatically.

Conclusion

We have talked a lot about technology today: Tekton, Sigstore, Argo CD, OpenShift. We’ve looked at diagrams and command lines. But I want to leave you with a thought about Trust.

For a long time, we treated security as a gate. It was a hurdle that developers had to jump over.

It was the “Department of No.” And because it was hard, and because it slowed people down, smart people found ways around it. That is how supply chains get broken. That is how vulnerabilities slip in. When security fights against velocity, velocity usually wins, and security suffers.

The approach we discussed today, this “Trusted Software Supply Chain”, flips the script entirely. It makes the secure way the easiest way.

Through the Trusted Software Supply Chain, Red Hat provides a tool for each of the three pillars: Transparency through the Trusted Profile Analyzer; Identity, thanks to the Trusted Artifact Signer; and Guardrails, with the Advanced Cluster Security for Kubernetes.

By embedding these checks into the platform itself, by using Red Hat OpenShift and these open source standards to automate the “boring” parts of compliance, we grant our developers the freedom to move fast. We give them the confidence to innovate, because we know the guardrails are solid. We stop asking them to be security experts and start giving them tools that are secure by default.

Sovereignty isn’t just about where your servers are physically located or which cloud provider you pay. Sovereignty is knowing, with mathematical certainty, exactly what software is running on those servers and exactly who put it there. It is about having total visibility and control over your digital assets.

So my challenge to you is this: Don’t leave your infrastructure to chance. Don’t rely on implicit trust. Build the factory. Sign your code. And take back control of your supply chain.

Thank you very much for your attention.

“Oktubre”, by “Patricio Rey y los Redonditos de Ricota” released in its entirety in October 1986, is widely considered to be one of the greatest albums of Argentine rock of all time. During that year they released various singles off the album, among them one called “Ji Ji Ji”, a song which has become the signature song of the band in the decades that followed.

As you can see on the cover, the band took some inspiration from the history and culture (that’s Latin for “clichés”) of the USSR, in the process even performing a horizontal symmetric transformation on the wrong letter; yes, I guess the illustrator didn’t know (or gloriously ignored) that it should have been a “Я” (called “Ya”), appearing in a context where it actually doesn’t make any sense whatsoever… so we got an inverted “B”… that doesn’t exist in the Cyrillic alphabet.

To my Russian readers, you can stop facepalming now. The final results are worth it, I promise.

The whole album is a very personal interpretation of the times we were living in 1986; cold war, Chernobyl, communism, nuclear scare, and whatnot, as seen from a country on the literal antipodes of the USSR, that was barely emerging from decades of intermittent on-and-off dictatorships. To my ears, the album sounds sometimes menacing, sometimes nostalgic, often tough, mostly terribly naïve.

The album is freely available in the official channel of the band (whose name can be roughly translated as “Patricio Rey and the Ricotta Bites”). The video contains the full album in order, with the original lyrics in Spanish.

Speaking about which, in case you’re interested, the lyrics don’t make much sense, not even in Spanish, and not only on this album; they have always been a weird thing with Los Redondos. It’s like they privileged the sounds of the words to their actual meaning, and hence people think that they convey some satanic or prophetic message.

It remains a favorite album of mine. I was finishing primary school when I heard it for the first time. My parents both detested Argentine rock; for my mother it was all about depravation and drugs and violence (and she was right to a point). I now firmly believe it’s a masterpiece of rock, regardless of country, language, inspiration, colors, or origin. It’s rich, layered, poetic, enthralling, fun, and of course to me, it brings oh so many memories.

Personal favorite songs: “Semen-Up” (yes, it’s a pun and the word means exactly the same in Spanish and in English), “Motor Psico”, and of course “Ji Ji Ji” which sends shivers down my spine.

The Redondos disbanded in the early 2000s, and the lead singer (known as “El Indio Solari”) continued his career with another band named “Los Fundamentalistas del Aire Acondicionado” (aka “The Air Conditioning Fundamentalists”). They played songs from the Redondos, of course, and had their masterpieces too, like “Beemedobleve” (2013). El Indio also had some incredible collaborations with other bands, including this anthem called “Angel de los Perdedores” (“Loser’s Angel”, 1997), with the most amazing lyrics:

The night shatters your glass, selling illusions
leaving you scraps of dreams, in the corners
But, baby, your laughter is the magic of rock ‘n’ roll
I bear the mark of your stings tattooed on me.

You healed all your wounds with rotten water
you lied to the devil three times, selling him flowers
and you carried the Loser’s Angel on your shoulders.

In 2017 the Fundamentalistas performed the biggest rock concert in the history of Argentina (and probably many other countries) in front of… 400'000 souls. They literally took over a whole city in the middle of the Pampas (called Olavarría) for a day.

This video is filmed from the pogo. Don’t watch if you are sensible to lights and shaking cameras. Do watch it if you want a good laugh. Fast-forward to minute 2:50 for the crowd singing the chorus of “Ji Ji Ji”. To say it’s epic is the understatement of the decade.

You have no idea the cult following around El Indio Solari and the Redondos. He’s a bit like our version of Hunter S. Thompson in all possible ways. Sadly, Indio announced being hit with Parkinson shortly after that megaconcert, and lives since then in seclusion in an undisclosed location, only known to a few close friends.

The final lyrics of “Ji Ji Ji” in English can be roughly translated as follows… and I’ll leave the interpretation to you.

The final cut is really intriguing
It’s actually really entertaining
You’re walking through the dark crowd, caught off guard
Bullying those who’ve loved you

I didn’t dream it, yeah, eh-eh-eh
He stood up straight and toasted to your luck
I didn’t dream it, yeah, eh-eh-eh
And he offered himself better than ever
I didn’t dream it, yeah, eh-eh-eh
You were running adrift
I didn’t dream it, yeah, eh-eh-eh
Blind eyes wide open
Please don’t look, and don’t turn on the light
The image has disfigured you, uh-oh, uh-oh, uh-oh, uh-oh

See?
There’s Chernobyl, Chernobyl
Chernobyl, Chernobyl
Chernobyl, Chernobyl

Speaking about El Indio Solari, here’s a picture I took in April in Buenos Aires; it is a graffiti at the corner of San Martín avenue and Punta Arenas street, in the neighborhood of La Paternal, showing El Indio, Maradona, the FIFA World Cup trophy, the seal of the Peronist party, and the veterans of Malvinas/Falklands. All strong symbols of my birthplace.

Update, 2026-06-12: I’m very sad to report that Carlos “El Indio” Solari passed away last Friday. He was 77 years old.

View this post on Instagram

View this post on Instagram

View this post on Instagram

Looking for options I discovered that Pandoc supports Typst since version 3.1.2, released in March 2023… but then I asked myself, what is Typst? Well it turns out it’s a new markup language coupled with a processor toolchain written in Rust; not just another one of those great “rewritings in Rust” but a new product, aiming at the same market than LaTeX but with all the speed of a Rust-built binary.

Typst provides all of the features I need, including syntax highlighting, math equation support, links as footnotes, and much more. So I gave it a shot, and with the help of Cursor I adapted the old LaTeX template used to generate PDF files into the one required by Typst, and I launched the generation of PDF files. The final templates are very readable I have to say, much more than the equivalent ones for LaTeX, that’s for sure.

So what happened? Well, the results were nothing short of spectacular. On my personal 2022 ThinkPad X1 Carbon (running Fedora 44) the time for a full build of all the PDF files for De Programmatica Ipsum went from more than 2 hours to… a mere 15 minutes 😳 ! And not only that, but there are many more configuration options available, providing much finer control over the final output.

I also adapted the PDF generation toolchain for my websites, and you can see the final products, for example on this website or on De Programmatica Ipsum. For reference, find below the Typst template I use for the PDFs generated with the contents of this website at the time of this writing.

// Pandoc Typst template
// Compatible with current Typst and Pandoc template variables.

#let horizontalrule = line(start: (25%, 0%), end: (75%, 0%))

#show terms: it => {
  it.children
    .map(child => [
      #strong[#child.term]
      #block(inset: (left: 1.5em, top: -0.4em))[#child.description]
    ])
    .join()
}

#set table(inset: 6pt, stroke: none)

#let admonition(title: [], strokeColor: rgb("#1976D2"), fillColor: rgb("#E7F1FB"), titleColor: rgb("#0D47A1"), body) = block(
  width: 100%,
  inset: (x: 10pt, y: 8pt),
  radius: 4pt,
  fill: fillColor,
  stroke: (left: (paint: strokeColor, thickness: 2.3pt)),
)[
  #set text(size: 0.88em, weight: "bold", fill: titleColor)
  #title
  #parbreak()
  #v(0.2em)
  #set text(size: 1em, weight: "regular", fill: black)
  #body
]

#show figure.where(kind: table): set figure.caption(position: $if(table-caption-position)$$table-caption-position$$else$top$endif$)
#show figure.where(kind: image): set figure.caption(position: $if(figure-caption-position)$$figure-caption-position$$else$bottom$endif$)

#let resolve-image-path = path => {
  if path.starts-with("/") or path.starts-with("http://") or path.starts-with("https://") {
    path
  } else {
    let rp = "$resource-path$"
    if rp == "" {
      path
    } else {
      rp + "/" + path
    }
  }
}

#let _image = image
#let image(path, ..args) = _image(resolve-image-path(path), ..args)

#let month-name = m => (
  if m == "01" { "January" }
  else if m == "02" { "February" }
  else if m == "03" { "March" }
  else if m == "04" { "April" }
  else if m == "05" { "May" }
  else if m == "06" { "June" }
  else if m == "07" { "July" }
  else if m == "08" { "August" }
  else if m == "09" { "September" }
  else if m == "10" { "October" }
  else if m == "11" { "November" }
  else if m == "12" { "December" }
  else { m }
)

#let ordinal = day => {
  let d = int(day)
  if calc.rem(d, 100) == 11 or calc.rem(d, 100) == 12 or calc.rem(d, 100) == 13 {
    [#d#("th")]
  } else if calc.rem(d, 10) == 1 {
    [#d#("st")]
  } else if calc.rem(d, 10) == 2 {
    [#d#("nd")]
  } else if calc.rem(d, 10) == 3 {
    [#d#("rd")]
  } else {
    [#d#("th")]
  }
}

#let format-commit-date = raw => {
  // Accept YYYY-MM-DD or ISO-like values and keep first 10 chars.
  let clean = if raw.len() >= 10 { raw.slice(0, 10) } else { raw }
  let parts = clean.split("-")
  if parts.len() == 3 {
    [#month-name(parts.at(1)) #ordinal(parts.at(2)), #parts.at(0)]
  } else {
    [#raw]
  }
}

#set smartquote(enabled: true)

$for(header-includes)$
$header-includes$

$endfor$

#show link: it => [
  #it.body
  #footnote(it.dest)
]

#show: doc => {
  set document(
$if(title-meta)$
    title: [$title-meta$],
$elseif(title)$
    title: [$title$],
$endif$
$if(subject)$
    description: [$subject$],
$endif$
$if(author-meta)$
    author: [$author-meta$],
$endif$
$if(keywords)$
    keywords: ($for(keywords)$[$keywords$]$sep$,$endfor$),
$endif$
  )

  $if(lang)$
  set text(lang: "$lang$")
  $endif$

  $if(mainfont)$
  set text(font: ("$mainfont$",))
  $else$
  set text(font: ("IBM Plex Sans",))
  $endif$

  $if(fontsize)$
  set text(size: $fontsize$)
  $endif$

  $if(monofont)$
  show raw: set text(font: ("$monofont$",))
  $else$
  show raw: set text(font: ("IBM Plex Mono",))
  $endif$

  set page(
    numbering: none,
    footer: context {
      let n = counter(page).get().first()
      if n > 1 {
        align(center, counter(page).display($if(page-numbering)$"$page-numbering$"$else$"1"$endif$))
      }
    },
  $if(papersize)$
    paper: "$papersize$",
  $endif$
  $if(margin)$
    margin: ($for(margin/pairs)$$margin.key$: $margin.value$,$endfor$),
  $else$
    // More balanced defaults for article PDFs.
    margin: (top: 2.6cm, bottom: 2.2cm, left: 2.2cm, right: 2.2cm),
  $endif$
  )

  doc
}

$for(include-before)$
$include-before$

$endfor$

$if(title)$
#align(center)[
  #set text(size: 1.55em, weight: "bold")
  $title$
  $if(subtitle)$
  #v(0.25em)
  #parbreak()
  #set text(size: 1.08em, weight: "regular")
  $subtitle$
  $endif$
  $if(date)$
  #v(0.15em)
  #parbreak()
  #set text(size: 0.50em, weight: "regular")
  #format-commit-date("$date$")
  #v(0.45em)
  #parbreak()
  $endif$
]

$if(abstract)$
#parbreak()
#heading(level: 1)[Abstract]
$abstract$
$endif$
$endif$

$if(image)$
#figure(
  image("$resource-path$/$image$"),
)
$endif$

$if(toc)$
#outline(
$if(toc-title)$
  title: [$toc-title$],
$else$
  title: auto,
$endif$
  depth: $toc-depth$,
)
$endif$

$if(lof)$
#outline(
  title: [List of Figures],
  target: figure.where(kind: image),
)
$endif$

$if(lot)$
#outline(
  title: [List of Tables],
  target: figure.where(kind: table),
)
$endif$

$body$

$if(citations)$
$if(csl)$
#set bibliography(style: "$csl$")
$elseif(bibliographystyle)$
#set bibliography(style: "$bibliographystyle$")
$endif$
$if(bibliography)$

#bibliography($for(bibliography)$"$bibliography$"$sep$,$endfor$)
$endif$
$endif$

$for(include-after)$

$include-after$
$endfor$

You can download an example output of this new PDF generation toolchain in the form of the file conway-in-c89.pdf, extracted using the source of the article with the same name.

The eiPott was this short-lived thingy made by Koziol in 2010: a small, colorful plastic dish where you could eat a hard-boiled egg.

The name (and the very shape of the thing, really) comes from the German words “Ei” (meaning “Egg”) and “Pott” (meaning… “pot”). And needless to say, the name was a pun around the word “iPod”, whereby in German you would pronounce “eiPott” similarly.

Of course Apple did not appreciate the joke, as the Mac Observer and many other news outlets reported back in the day. It was far more than a simple “cease-and-desist” thing; Apple literally took the infringement to the courts, and a German judge sided with Steve Jobs on this one. The settlement involved some fines and everything.

I remember posting a message on Twitter (remember? Yeah, those were the days) about the eiPott, and then I got a call from Bertrand, and we were both laughing uncontrollably about the thing for a while. We both thought it was as brilliant as it was clumsy; he had a law degree, so he knew that playing such a game wasn’t going to come for free. But he loved the pun, a lot.

And next thing I know, a few days later I received a package in the post; a Koziol eiPott, bought by Bertrand and delivered to my place. He was like this. I still have my eiPott, proudly displayed in my home office, and every time I see it I remember him.

I miss Bertrand. 2016 was really a terrible year. We lost so much.