> The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters. There's a really fascinatin

> The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters. There's a really fascinating project by the authors of TUF called in-toto[1] that addresses exactly this problem. [1] https://in-toto.github.io/ https://in-toto.github.io/