Post #1434850
2023-01-01 09:37 UTC
@Di4na True, you are not a supplier, but the packager of your code is. Your article conflates the dependency graph with the supply chain, which hides this distinction. Happy new year!
Replies (1)
-
@Di4na@hachyderm.io 2023-01-01 19:26
@dirkriehle Except nope, most packagers are not different but also the packagers are not the ones targeted by the Supply Chain people these days. The packager is not the one that has to sign their commits as an example or make sure the library can be built reproducibly.