Thank you for reading through it and summarizing. I disagree with your conclusion however. It's not possible for someone to completely trace upstream dependenc

Thank you for reading through it and summarizing. I disagree with your conclusion however. It's not possible for someone to completely trace upstream dependencies in a SLSA compliant manner. No company can sanely expect that. What can be done is to say "we have some code from outside. How can we attribute it to upstream and make sure it has not been altered?" You can use signatures from the maintainers, version it, even reference a git commit. I don't think that anything additional from maintainers should be required, it's on the company to figure out how best to do so.