From 539d114a7ba84ad43370887573d1e840da26a354 Mon Sep 17 00:00:00 2001 From: Tom Hennen Date: Tue, 10 Dec 2024 20:05:38 +0000 Subject: [PATCH] Build Environment Track isn't perfect Signed-off-by: Tom Hennen --- docs/spec/draft/threats.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/spec/draft/threats.md b/docs/spec/draft/threats.md index b13e6f86f..d5c12a30e 100644 --- a/docs/spec/draft/threats.md +++ b/docs/spec/draft/threats.md @@ -871,7 +871,8 @@ including OS images, as any other artifact to be verified prior to use. The threats described in this document apply recursively to build tooling as do the mitigations and examples. A future [Build Environment track](future-directions#build-environment-track) may -provide more comprehensive guidance on how to address this threat. +provide more comprehensive guidance on how to address more specfiic +aspects this threat. *Example:* MyPackage is a tarball containing an ELF executable, created by running `/usr/bin/tar` during its build process. An adversary compromises the