Software supply chain security protects source code, build processes, dependencies, artifacts, and delivery mechanisms from compromise or unauthorized modification. It establishes confidence in what happened between development and deployment while minimizing manual work. section 4.3.1
A practical platform pattern combines supply chain audits, policy as code, and compliance automation at the point of change. Teams can require personally identifying commit keys and configure platform-provided repositories to accept only valid signed commits. section 4.3.1
SolarWinds compromise
Attackers modified source code through build servers, making malicious changes appear legitimate. Customers then installed the compromised code through ordinary updates because the CI/CD process had signed it. section 4.3.1
Figure 4.6 Software created by users of our platform follows a known path. Developers create code, the pipeline creates an executable version and stores it, and then the pipeline deploys the executable to the target environment. Depending on the type of application, end-users may get a copy to run themselves.
Trace the known path from developer-created code through pipeline-built executables and deployment to target environments. section 4.3.1
Figure 4.7 Steps along the way, from code creation to deployment, can automatically create the necessary provenance.
Follow how each step from code creation to deployment can automatically generate provenance. section 4.3.1
