<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Chris Lamb pushed to branch master
at <a href="https://salsa.debian.org/reproducible-builds/reproducible-website" style="color: #1068bf; text-decoration: none;">Reproducible Builds / reproducible-website</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/17ca3358b1408903d68490a9474d895bac7846b5" style="color: #1068bf; text-decoration: none;">17ca3358</a></strong>
<div>
<span>by Sebastian Crane</span>
<i>at 2022-06-05T22:41:58+01:00</i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fafafa; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dbdbdb;'>2022-05: SPDX team for build metadata
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">1 changed file:</h4>
<ul>
<li class="file-stats">
<a href="#38443d9c4b4dc531991bc040d3a1d513934ac1d3" style="color: #1068bf; text-decoration: none;">
_reports/2022-05.md
</a>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">Changes:</h4>
<li id="38443d9c4b4dc531991bc040d3a1d513934ac1d3">
<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/17ca3358b1408903d68490a9474d895bac7846b5#38443d9c4b4dc531991bc040d3a1d513934ac1d3" style="color: #1068bf; text-decoration: none;"><strong style="font-weight: bold;">_reports/2022-05.md</strong></a>
<hr style="overflow: hidden; border: 1px solid #e1e1e1;">
<table class="code white" style="border-spacing: 0; border-collapse: collapse; width: auto; font-family: monospace; font-size: 90%;" bgcolor="#fff" width="100%" cellpadding="0" cellspacing="0">
<tr class="line_holder match" style="line-height: 1.6;">
<td class="diff-line-num unfold js-unfold old_line" data-linenumber="41" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">...</td>
<td class="diff-line-num unfold js-unfold new_line" data-linenumber="41" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">...</td>
<td class="line_content match" style="color: rgba(0,0,0,0.3); padding: inherit;" bgcolor="#fafafa">@@ -41,6 +41,20 @@ Johannes Schauer discovered a fascinating bug where simply naming your Python va</td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="41" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
41
</td>
<td class="new_line diff-line-num" data-linenumber="41" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
41
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC41" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="42" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
42
</td>
<td class="new_line diff-line-num" data-linenumber="42" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
42
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC42" class="line" lang="markdown">Simply renaming the dummy method from <span class="sb" style="color: #d14;">`_m`</span> to <span class="sb" style="color: #d14;">`_b`</span> was enough to workaround the problem. <span class="p">[</span><span class="nv" style="color: #008080;">Johannes' bug report</span><span class="p">](</span><span class="sx" style="color: #d14;">https://github.com/python/cpython/issues/92132</span><span class="p">)</span> first led to a number of improvements in <span class="ge" style="font-style: italic;">*diffoscope*</span> to aid in dissecting <span class="sb" style="color: #d14;">`.pyc`</span> files, but upstream identified this as caused by an issue surrounding <span class="p">[</span><span class="nv" style="color: #008080;">interned strings</span><span class="p">](</span><span class="sx" style="color: #d14;">https://en.wikipedia.org/wiki/String_interning</span><span class="p">)</span> and is being tracked in <span class="p">[</span><span class="nv" style="color: #008080;">CPython bug #78274</span><span class="p">](</span><span class="sx" style="color: #d14;">https://github.com/python/cpython/issues/78274</span><span class="p">)</span>.</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="43" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
43
</td>
<td class="new_line diff-line-num" data-linenumber="43" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
43
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC43" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
44
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC44" class="line" lang="markdown"><span class="gu" style="color: #800080; font-weight: 600;">#### SPDX forms new team to bring build metadata to Software Bill of Materials</span></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="45" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
45
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC45" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="46" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
46
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC46" class="line" lang="markdown"><span class="p">[</span><span class="nv" style="color: #008080;">SPDX, the open standard for Software Bill of Materials (SBOM)</span><span class="p">](</span><span class="sx" style="color: #d14;">https://spdx.dev</span><span class="p">)</span>, is continuously developed by a number of teams and committees. SPDX now welcomes a new addition - a team dedicated to enhancing metadata about software builds, complementing reproducible builds in creating a more secure software supply chain. The SPDX Builds Team has been working throughout May to define the universal primitives shared by all build systems, including the 'who, what, where and how' of builds:</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="47" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
47
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC47" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="48" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
48
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC48" class="line" lang="markdown"><span class="p">*</span> Who: the identity of the person or organisation that controls the build infrastructure</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="49" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
49
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC49" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="50" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
50
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC50" class="line" lang="markdown"><span class="p">*</span> What: the inputs and outputs of a given build, combining metadata about the build's configuration with an SBOM describing source code and dependencies</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="51" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
51
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC51" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="52" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
52
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC52" class="line" lang="markdown"><span class="p">*</span> Where: the software packages making up the build system, from build orchestration tools such as <span class="p">[</span><span class="nv" style="color: #008080;">Woodpecker CI</span><span class="p">](</span><span class="sx" style="color: #d14;">https://woodpecker-ci.org/docs/intro</span><span class="p">)</span> and <span class="p">[</span><span class="nv" style="color: #008080;">Tekton</span><span class="p">](</span><span class="sx" style="color: #d14;">https://tekton.dev/</span><span class="p">)</span> to language-specific tools</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="53" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
53
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC53" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="54" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
54
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC54" class="line" lang="markdown"><span class="p">*</span> How: the invocation of a build, linking metadata of a build to the identity of the person or automation tool that initiated it</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="55" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
55
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC55" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="56" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
56
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC56" class="line" lang="markdown">The SPDX Builds Team expects to have a usable data model by September, ready for inclusion in the upcoming SPDX 3.0 standard. The team welcomes new contributors, inviting those interested in joining to introduce themselves on the <span class="p">[</span><span class="nv" style="color: #008080;">SPDX Tech mailing list</span><span class="p">](</span><span class="sx" style="color: #d14;">https://lists.spdx.org/g/spdx-tech</span><span class="p">)</span>.</span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="57" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
57
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'>+<span id="LC57" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="44" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
44
</td>
<td class="new_line diff-line-num" data-linenumber="58" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
58
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC58" class="line" lang="markdown"><span class="gu" style="color: #800080; font-weight: 600;">#### Supply-chain security attacks</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="45" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
45
</td>
<td class="new_line diff-line-num" data-linenumber="59" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
59
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC59" class="line" lang="markdown"></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="46" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
46
</td>
<td class="new_line diff-line-num" data-linenumber="60" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: inherit;" align="right" bgcolor="#fafafa">
60
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 0.8125rem; color: #303030; position: relative; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dbdbdb;'> <span id="LC60" class="line" lang="markdown">This was another bumper month for supply-chain attacks in package repositories. Early in the month, Lance R. Vick noticed that the maintainer of the NPM <span class="sb" style="color: #d14;">`foreach`</span> package let their personal email domain expire, so they bought it and now "<span class="p">[</span><span class="nv" style="color: #008080;">controls `foreach` on NPM and the 36,826 projects that depend on it</span><span class="p">](</span><span class="sx" style="color: #d14;">https://mastodon.social/@lrvick/108274265429826806</span><span class="p">)</span>". Shortly afterwards, <span class="p">[</span><span class="nv" style="color: #008080;">Drew DeVault</span><span class="p">](</span><span class="sx" style="color: #d14;">https://drewdevault.com/</span><span class="p">)</span> published a related blog post titled <span class="p">[</span><span class="nv" style="color: #008080;">*When will we learn?*</span><span class="p">](</span><span class="sx" style="color: #d14;">https://drewdevault.com/2022/05/12/Supply-chain-when-will-we-learn.html</span><span class="p">)</span> that offers a brief timeline of major incidents in this area and, not uncontroversially, suggests that the "correct way to ship packages is with your distribution’s package manager".</span>
</pre></td>
</tr>
</table>
<br>
</li>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
<a href="https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/17ca3358b1408903d68490a9474d895bac7846b5" style="color: #1068bf; text-decoration: none;">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/17ca3358b1408903d68490a9474d895bac7846b5"}}</script>
</p>
</div>
</body>
</html>