ppkarwasz commented on PR #706: URL: https://github.com/apache/commons-parent/pull/706#issuecomment-4458118627
These refers to the different SLSA tracks (see [specification](https://slsa.dev/spec/v1.2/tracks)) that I mentioned in apache/commons-release-plugin#422. Summarizing: 1. The source track shows relationships between source commits, 2. The build track shows relationships between a source commit and built artifacts. Recent supply-chain attack have often: - Built artifacts from a commit that was never part of a repo. It was a commit on a fork, which was tagged. - Built artifacts in a different way than the original artifact (e.g. on an attacker-controlled machine instead of GitHub Actions). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
