2 ms·
This assumes that you trust the manifest from Alice. You rely on Alice being truthful to evaluate the risk in trusting Alice. This is a catch-22.
by remram 4y ago
This assumes that you trust the manifest from Alice. You rely on Alice being truthful to evaluate the risk in trusting Alice. This is a catch-22.
- lucideer 4y agoI'm not sure we're talking about the same thing. What manifest are you referring to here? The post is detailing a feature offered by GitHub to generate SBOMs from source code repositories - these will provide machine-readable inventory based on the files within the repository. You can upload a dependency graph to feed the SBOM as an out-of-band step, but trusting Alice's out-of-band dep graph is only a function of access to the source code as a source of truth. Ultimately that's what all if this comes down to: creating a machine-readable graph from a predicable central place that tells us information we could have ascertained ourselves before anyway (just with considerably more effort).