"Critical" projects and volunteer maintainers

"Critical" projects and volunteer maintainers

That assumes that the maintainer of libfoo bothers to do that - you may well find that you have to do the same work tracking down all of their transitive dependencies, because they're only certifying their own code, and not the code they depend upon.

Without careful communication, you can end up in two "bad" places:

1. You contacted the maintainer of libfoo, and got agreement, but they didn't bother getting the same agreement from their dependencies. You're still exposed by libfoo's dependencies, you just don't know it.
2. You contacted the maintainers of the transitive closure of your dependencies, including the maintainer of libfoo. They take it upon themselves to contact their transitive closure of dependencies, upsetting people who've been contacted 2 (or more) times because you're taking a critical dep on their software.

Supply chain security is not a trivial problem when you have a commercial relationship with your suppliers - it's even harder when they're volunteers.