3 ms·
It's trivial to insert software into the build pipeline without being noticed. Run your own devpi server, build a compromised version of any dependency you wan
by MPSimmons 8y ago
It's trivial to insert software into the build pipeline without being noticed.
Run your own devpi server, build a compromised version of any dependency you want, and you can install whatever you would like, with no sign of it in the Dockerfile.