search

openfga / helm-charts

Official Helm charts for the OpenFGA project.
https://openfga.dev
Apache License 2.0
19 stars 35 forks source link

An external dependency to groundnuty/k8s-wait-for is pinned using tag. #144

Open aaguiarz opened 3 months ago

aaguiarz commented 3 months ago

Source tags can be overwritten in case of a supply chain attack and a compromised image may be pulled down.

The risk is greater in the case of external, third party dependencies not under the projects control.