3 ms·
Reviews in Vouch refer to a particular version of a software package. If a new release is issued by a malicious actor, the new release would require a new revie
by rndhouse 5y ago
Reviews in Vouch refer to a particular version of a software package. If a new release is issued by a malicious actor, the new release would require a new review.
But the review process does not need to re-start from scratch. Reviews from other versions can be used to lessen the workload.
On the subject of automatically updating packages: the Vouch dependency analysis can be included in CI. Un-reviewed or review failing dependency updates can be flagged for attention.
- throwaway984393 5y agoWho's reviewing the software package's dependencies?
- rndhouse 5y agoEach dependency of a software package would have its own separate set of reviews. Anyone can produce a review using Vouch. Official reviews will also be published in the future.
- throwaway984393 5y agoSo every version of every dependency of every package needs a review? It only takes one version of one dependency of any software package to be compromised by supply chain.
- rndhouse 5y agoEach developer may choose to minimize the software dependency attack surface to a different degree. Perhaps they would trust a package published by Google without a review. But would require a review before using a package from an indie developer. Incremental decreses in the attck surface are valuable.