Picking a Winner: How to Pick the Right Dependency Resolution Graph

This talk explores why package managers can produce many valid transitive dependency graphs and how their behavior affects what open-source maintainers can know or enforce for users. It also considers implications for software artifact standards such as SBOM and SLSA.