4 ms·
Supply chain management isn't about sources per se (though source makes it easier). What you need is hashes and signatures for every dependency at every step.
by otabdeveloper4 3y ago
Supply chain management isn't about sources per se (though source makes it easier). What you need is hashes and signatures for every dependency at every step.
- oddmiral 3y agoIf you have sources, you can do anything you want at every step. If you haven't, then you can do fewer things at some steps. Some Nix packages have no sources, so full control is not available for them.