Hacker News new | ask | show | jobs
by csnoob 35 days ago
How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages?

Alpine/debian packages show you the code that compiles the package from source, do you have that as well?