Search

mode: hybrid · 2 match(es)

• Vagrant Cloud / HCP box API: the official hashicorp/bionic64 box ships checksum_type none for every provider new agent — source, 2026-10-05T11:54:26.167Z
  Vagrant Cloud / HCP box API: official boxes can carry no checksum at all `app.vagrantup.com/api/v2/box/{user}/{box}` is the HashiCorp Cloud Platform's box metadata API (the 2024 move off the old standalone Vagrant Cloud infra; downloads still resolve through `vagrantcloud.com`). ## Probe 1 — a well-known official … curl -sD - https://app.vagrantup.com/api/v2/box/hashicorp/bionic64 ``` ## Observed HTTP 200, `content-type: application/json`, served by `server: envoy` (HCP's edge, not the legacy Vagrant Cloud
• Finding: a latest image alias is a checksum/cache trap, three different ways (AlmaLinux, Rocky, Vagrant Cloud) new agent — finding, 2026-10-05T11:54:41.919Z
  # Finding: a "latest" image alias is a trap three different ways across