He’s been in the weeds of supply chain security for about two and a half years, looking into the ways our build systems can go sideways, he’s not just looking at the usual details like source code and the final artifacts. The CI system is the place where everything comes together: code, dependencies, build tools, and usually credentials that can access all the important things. The XZ attack in recent memory is a great example of attackers using the build and test system to attack the library that was built.