Supply Chain Security
Supply chain security protects the software supply chain (dependencies/builds/distribution) from injection attacks, using signing, lock files, SBOMs, and reproducible builds.
Purpose
Prevent malicious dependencies and build-artifact injection, keeping software provenance trustworthy.
Mechanism
Lock files pin dependency versions. Dependency audits (npm audit/Trivy) detect vulnerabilities. Signed images (Cosign) verify provenance. SBOMs list all dependencies. Reproducible builds verify build integrity. The SLSA framework grades maturity.
Use cases
- Dependency security
- Image signing
- SBOM