Skip to content

Latest commit

 

History

History
16 lines (9 loc) · 557 Bytes

recommendations-chains.md

File metadata and controls

16 lines (9 loc) · 557 Bytes
Raw

The CHAINS software supply chain recommendations

Based on our readings and research, we came to the following conclusions.

-- The Chains team

Strongly recommends

  • CHAINS strongly recommends checking and enforcing reproducible builds
  • CHAINS strongly recommends the usage of dependency pinning. In Maven, this mean strict versions in the pom + Maven lockfile.

Encourages

  • CHAINS encourages transparency logs over releases and packages using verifiable data structures
  • CHAINS recommends using functional package managers in CI (Guix, NIX)