Hi @mssun, as we talked, the `Graphene` will download several dependent 3rd party's codebases during building time. e.g. [glibc](https://github.com/oscarlab/graphene/blob/9f0943e39432e5440066c8448780a08eb4254c77/LibOS/Makefile#L117), [mbedtls](https://github.com/oscarlab/graphene/blob/30013c6754e9f8aed25bb887cb5994a17ad4efcc/common/src/Makefile#L59), [uthash](https://github.com/oscarlab/graphene/blob/30013c6754e9f8aed25bb887cb5994a17ad4efcc/common/src/Makefile#L134), [toml](https://github.com/oscarlab/graphene/blob/30013c6754e9f8aed25bb887cb5994a17ad4efcc/common/src/Makefile#L152), [gcc](https://github.com/oscarlab/graphene/blob/8c7ac33f80d403b388248ea7827996cb0cc74019/LibOS/Makefile#L183). all downloads are verified by hashcodes, however, the document mentioned `will only consume packages from this designated repository and will not download any code from external package registry` in page [THIRD-PARTY DEPENDENCY VENDORING](https://teaclave.apache.org/docs/codebase/third-party/). does it comply with what is mentioned in the document if linking `Graphene` as one of submodules in `Teaclave` project ? Thanks.
-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/apache/incubator-teaclave/issues/525#issuecomment-886410294
