This one is a little bit out there, but AI-assisted source code is probably coming sooner than later. I imagine that people like the US Federal Government are going to be very interested in knowing precisely where their source code came from in this new world.
Part of the solution is in marking which dependencies use AI-assisted code in SBOMs, but that doesn't solve the whole problem, because it doesn't say which bits of the code were AI-assisted or not. So I imagine there's room for an attestation which gives you this information. Or maybe that should be the job of an SCM commit now, I'm not sure. My point is that we should think about this.
Related to #124, and should actually be a part of whatever solution we come up there.
Why this is no longer sci-fi:
This one is a little bit out there, but AI-assisted source code is probably coming sooner than later. I imagine that people like the US Federal Government are going to be very interested in knowing precisely where their source code came from in this new world.
Part of the solution is in marking which dependencies use AI-assisted code in SBOMs, but that doesn't solve the whole problem, because it doesn't say which bits of the code were AI-assisted or not. So I imagine there's room for an attestation which gives you this information. Or maybe that should be the job of an SCM commit now, I'm not sure. My point is that we should think about this.
Related to #124, and should actually be a part of whatever solution we come up there.
Why this is no longer sci-fi: