slsa
slsa copied to clipboard
Clarify: supply chain represented as a DAG (Direct Acyclic Graph)
In https://slsa.dev/spec/v1.0-rc1/terminology, section "Software supply chain" we can read:
We represent a supply chain as a directed acyclic graph of sources, builds, dependencies, and packages.
and below is a picture, where a supply chain is drawn as a DAG with filled lines, but the graph also contains dotted lines that makes the graph cyclic.
To not confuse a reader, maybe add some clarifications on the meaning on dotted vs filled lines, or some other visual guidance that would aid a reader to understand that there no cycles in this supply chain, but dependencies are built on other supply chains.