I understand your point. But that is explicitly not the point the SLSA are making, nor any of the thought leadership on this. The reality of opensource are tot

I understand your point. But that is explicitly not the point the SLSA are making, nor any of the thought leadership on this. The reality of opensource are totally absent in these discussions. Noone say the things you just said. I understand why you think it should be obvious and how it is done, but that is simply not the reality out there.