Simple definition
Software supply-chain security protects the stages, components and participants involved in building and delivering software.
Purpose and use
It aims to limit unauthorized changes to source, dependencies, build processes and distributed artifacts.
How does it work?
Controls can connect access management, code review, managed dependencies, isolated builds, signatures and provenance verification.
Key points
- Example: before deployment, a team checks that an artifact matches the expected repository and build process.
- Retain versions, dependencies and useful attestations, then verify their consistency during delivery.
Points to watch
A signature establishes a relationship to a key, not the absence of vulnerabilities. A component inventory does not replace provenance verification.
In short
Supply-chain security controls how an artifact is produced, identified and verified.