Develop software supply chain risks FAQ

[dave2wave]

Let's review various supply chain risks and create a FAQ section of the tooling website.

[dave2wave]

From @potiuk SLSA threat model https://slsa.dev/spec/v0.1/threats

[sbp]

Whoops, I added this to the ATR board because we have the same plans there. In our documentation we refer to security hardening in the face of supply chain attacks, but we need to document exactly what our threat model is and what our hardening actions have been.

[potiuk]

Super cool. I am happy to collaborate on it :)

[potiuk]

Actually ... my original link was out-dated: https://slsa.dev/spec/v1.2-rc2/threats is the latest RC

"We're living on the edgeeeeeee...."

[dave2wave]

Root for the section is: https://github.com/apache/tooling-docs/blob/main/content/pages/supply-chain.md