Supply Chain Integrity: The Role of Verified Reproducible Builds
David Wheeler, director of open-source supply chain security, Linux Foundation The SolarWinds supply chain compromise has raised questions about how organizations can detect software that has been tainted during the vendor’s development and build process. “It doesn’t matter how good or how secure your source code is because what your customers are actually installing could be malicious, which is exactly what happened in the SolarWinds case,” says David A. Wheeler, director of open-source supply chain security at the Linux Foundation. The idea of a verified reproducible build is gain...
Source: healthcareinfosecurity.com