undefined | Better HN

0 pointsrndhouse4y ago0 comments

Reviews in Vouch refer to a particular version of a software package. If a new release is issued by a malicious actor, the new release would require a new review.

But the review process does not need to re-start from scratch. Reviews from other versions can be used to lessen the workload.

On the subject of automatically updating packages: the Vouch dependency analysis can be included in CI. Un-reviewed or review failing dependency updates can be flagged for attention.

0 comments

3 comments · 1 top-level

throwaway9843934y ago· 2 in thread

Who's reviewing the software package's dependencies?

rndhouseOP4y ago

Each dependency of a software package would have its own separate set of reviews.

Anyone can produce a review using Vouch. Official reviews will also be published in the future.

throwaway9843934y ago

So every version of every dependency of every package needs a review? It only takes one version of one dependency of any software package to be compromised by supply chain.

1 more reply

j / k navigate · click thread line to collapse