Hacker News Reader

SBOM/chain of custody all the way back to an individual doing a commit.

This is the opposite of a specific threat vector

Software supply chain attacks not specific enough?

Not in terms of specific threat model.

Threat: attacker can commit malicious code to a repository by impersonation.

Mitigation: verify commit signatures.