Software Supply Chain Security
Software supply chain security protects the code, dependencies, build systems, and release artifacts that your software relies on. It helps you know what you use, how it was produced, and whether it changed.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Software Supply Chain Security
Software rarely arrives as one team's source code. A release depends on source repositories, package registries, build services, CI identities, compilers, containers, and deployment systems. Each dependency and process becomes part of the software supply chain.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/218/final
Supports
- Secure software development practices integrated into existing lifecycle models
- Reducing vulnerabilities and their impact through secure development practices
- https://slsa.dev/spec/v1.2/
Supports
- SLSA tracks, levels, provenance, and verification guidance
- Increasing security guarantees for source and build supply chains
- https://docs.sigstore.dev/
Supports
- Signing and verification of artifacts and SBOMs
- Identity-bound signing and transparency-log verification
- https://docs.github.com/en/code-security/concepts/supply-chain-security/supply-chain-security
Supports
- Direct and transitive dependency inventory
- Dependency review, vulnerability alerts, updates, immutable releases, and artifact attestations
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Curated discovery of software supply chain security tools and resources
- in-toto, OpenSSF Scorecard, and zizmor as relevant ecosystem resources
- https://in-toto.io/
Supports
- An open framework and tooling for recording supply-chain steps, actors, and order
- https://scorecard.dev/
Supports
- Automated security checks across source code, build, dependencies, testing, and maintenance
- https://github.com/zizmorcore/zizmor
Supports
- Static analysis of CI/CD configurations including GitHub Actions, Dependabot, and pre-commit