Also known as: SSCS · supply chain integrity
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
The discipline emerged from the recognition that modern applications are assembled far more than they are written. A typical service may contain a handful of first-party files and hundreds of transitive dependencies, any one of which is a potential compromise vector.
Practical work centres on knowing what you ship (SBOMs), proving how it was built (attestations and reproducible builds), verifying who produced it (signing), and controlling what can enter (dependency pinning, internal registries, review of new dependencies).
SBOM
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.
Code Signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
Dependency Confusion
Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry using the same name as an organisation's internal private package, causing build tooling to fetch the attacker's version instead.
SLSA
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.