Anonymous
The software supply chain security improvements for Dart & Flutter required generating a signed bill of materials for every artifact shipped to final users. Even though the complexity of the implementation relied on proper isolation of the build process from the process of collecting the bill of materials and providing a remote signed workflow a setback came from the most unexpected place.
The project to protect the software supply chain was already completed and the final step in the release workflow of the feature required publishing a public key so that the final customer could validate the signature. However, being the first Google open source project implementing a software supply chain I didn’t account for the complexity of releasing the public key associated with the Google signing key. Solving this problem required a lot of negotiation with security teams at the Google organization level.
It was frustrating that everything else was completed and the only thing missing was releasing a key. However because the processes associated with that key was making Google accountable for the artifacts signed with the associated private key. The security and legal teams wanted to be extra careful before releasing it. I had to provide documentation and support for a few extra audits before the key was finally released after a couple of months of negotiations and collaboration with security and legal teams.