Dependency supply chains and provenance

Knowledge package outline

Topic

Computation and software foundations

Purpose

Shows why a package name is not sufficient trust evidence.

Package contents

Dependency trees; signatures concepts; update review.

Dependencies

Software builds; security literacy.