[Suggestion] Review NPM supply chain proposal and make recommendations

[lumjjb]

Description: Review NPM supply chain proposal and make recommendations

Impact: Review the proposal and ensure that it is in line with CNCF supply chain whitepaper and software factory reference architecture.

Scope: A couple hours from a community member

Additional info:

• NPM Proposal: https://github.com/npm/rfcs/blob/link-packages-to-source-and-build/accepted/0000-link-packages-to-source-and-build.md
• Software Factory Ref Arch Paper: https://github.com/cncf/tag-security/blob/main/supply-chain-security/secure-software-factory/Secure_Software_Factory_Whitepaper.pdf
• Cloud Native Supply Chain Best Practices Paper: https://github.com/cncf/tag-security/blob/main/supply-chain-security/supply-chain-security-paper/CNCF_SSCP_v1.pdf

[mlieberman85]

I have been providing feedback myself. I think by and large it's good as a first step. Also, will be setting up some conversations with the leads.

[PushkarJ]

@mlieberman85 any updates on this?

(Just doing this as part of triage in working session)

[stale[bot]]

This issue has been automatically marked as inactive because it has not had recent activity.

[anvega]

Proposal is now merged