Great writeup! The supply chain is one of the weakest links in the software development process today due to the implicit trust developers have in the open sou

Great writeup! The supply chain is one of the weakest links in the software development process today due to the implicit trust developers have in the open source ecosystem, so I'm glad to see more interest in projects like in-toto.