4 ms·
The best description of this I've seen is "chain of custody": Like with evidence in criminal proceedings. Docker and Git's use of content-addressable hashes hel
by 13security 6y ago
The best description of this I've seen is "chain of custody": Like with evidence in criminal proceedings. Docker and Git's use of content-addressable hashes helps in this regard, but there is still considerable work to be done when tracking third-party dependencies.
- jacques_chester 6y agoWe used "chain of custody" as our analogy for buildpacks when I was working on them. It's not completely accurate, though, for the same reason as "supply chain". There isn't a single linear sequence of agents, actions and assets for a given asset. It's a graph in which things can appear many times in many permutations.
- kitplummer 6y agoLike In-Toto? https://landscape.cncf.io/selected=in-toto https://landscape.cncf.io/selected=in-toto