What is software supply chain security

Thu, 04 Aug 2022 15:21:01 +0200

An earlier version of this material was published in the first chapter of the Linux Foundation Sigstore course.

Software producers have a supply chain just like manufacturing businesses have a supply chain. And just like manufacturers require physical inputs and then perform a manufacturing process to build a finished product, so do software producers, whether the producer is a company or individual. In other words, a software producer uses components, developed by third parties and themselves, and technologies to write, build, and distribute software. A compromise introduced anywhere in this chain is an example of a software supply chain security issue. Tools and practices like those implemented in Chainguard’s containers help organizations protect against these risks through built-in SBOMs, provenance attestations, and SLSA compliance.

John Speed Meyers on

What is software supply chain security