Hacker News new | past | comments | ask | show | jobs | submit login

I agree, but that's not sufficient in an open source software supply chain. You also need to inspect the dependencies and you need to do this every time you pull any new versions.



Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: