slsa icon indicating copy to clipboard operation
slsa copied to clipboard

Clarify: supply chain represented as a DAG (Direct Acyclic Graph)

Open kommendorkapten opened this issue 2 years ago • 0 comments

In https://slsa.dev/spec/v1.0-rc1/terminology, section "Software supply chain" we can read:

We represent a supply chain as a directed acyclic graph of sources, builds, dependencies, and packages.

and below is a picture, where a supply chain is drawn as a DAG with filled lines, but the graph also contains dotted lines that makes the graph cyclic.

To not confuse a reader, maybe add some clarifications on the meaning on dotted vs filled lines, or some other visual guidance that would aid a reader to understand that there no cycles in this supply chain, but dependencies are built on other supply chains.

kommendorkapten avatar Feb 27 '23 08:02 kommendorkapten