News for hackers. Stuff that matters.

A comment on Software supply chain security. Parent comment

Re:Software supply chain security by p932 on Friday September 04, 2020 @05:42AM (#24373371)
How this pattern/toolset protect against supply chain compromises of the dependencies used to build the "Datadog Agent" itself?
[ Parent | on HN ]
Re:Software supply chain security by trishankdatadog on Friday September 04, 2020 @11:18AM (#24375686)
Apply pattern/toolset recursively. Software supply chain problems largely eventually solved this way.
[ Parent | on HN ]
Re:Software supply chain security by p932 on Friday September 04, 2020 @12:47PM (#24376609)
Is there any initiative in this direction towards applying this pattern on big dependency management tools (e.g maven, pip, npm)?
[ Parent | on HN ]
Re:Software supply chain security by trishankdatadog on Saturday September 05, 2020 @08:04PM (#24387814)
Yes, please see PEP 458: https://www.python.org/dev/peps/pep-0458/
[ Parent | on HN ]