The Registry URL Was Right. The Source Wasn’t.

A trusted address is not the same thing as a trusted source.

Coder’s August 2026 registry security incident illustrates the difference. According to Coder’s first-party disclosure, an unauthorized actor compromised a Cloudflare API key and redirected part of the traffic for registry.coder.com to attacker-controlled infrastructure. The malicious servers then distributed modified registry modules designed to discover and exfiltrate cloud, CI/CD, SSH, and other credentials.

Users could request the expected hostname.

The hostname could resolve successfully.

The institutional custody behind the source had changed.

Source Identity and Source Custody Are Different

Information systems often represent trust through identifiers: domains, repository names, API endpoints, package namespaces, certificates, account names, or service URLs.

Those identifiers are useful because they provide stable references.

But an identifier does not itself prove who currently controls the delivery path or whether the object returned belongs to the expected lineage.

Source continuity therefore requires at least two relationships:

this is the source we intended to contact, and the source is still under the custody and authority we intended to trust.

The Topology Break Happens Before Evidence Is Consumed

In GovKM’s Continuity Topology, Source comes first for a reason.

If Source identity is accepted without verifying custody and integrity, every later relationship inherits the defect:

Source identity → publisher authority → artifact evidence → deployment context → action.

A signed or hashed artifact can strengthen this relationship. So can verified publisher identity, immutable release metadata, independent transparency records, and reproducible provenance. But a familiar hostname alone cannot establish all of them.

Continuity Must Survive Infrastructure Change and Compromise

Cloud infrastructure is dynamic. DNS changes. CDNs shift. providers migrate. certificates renew. registries move. keys rotate.

Continuity does not require freezing those systems. It requires preserving enough evidence to distinguish legitimate infrastructure change from unauthorized custody change.

The same principle applies outside software supply chains. An agency portal, shared drive, vendor repository, model endpoint, or external data feed can retain the same identifier while its owner, operator, authority, or contents change.

Reconstruction Is Part of the Incident

Coder also noted limits on reconstructing every affected deployment because some relevant infrastructure and logs were controlled by the attacker.

That makes provenance local as well as central.

Organizations consuming external artifacts need enough of their own records—network logs, package caches, execution history, hashes, credential state—to reconstruct what they actually received and used when the upstream provider cannot supply a complete history.

The GovKM Proposition

Source identity is not source custody.

A trustworthy system must preserve the relationship among the identifier, the authority controlling it, the infrastructure serving it, and the lineage of the object returned.

The registry URL can be correct while the source relationship behind it is no longer trustworthy.

Continuity requires the institution to know the difference.