DevOps · interactive

Software supply chain security

Most of the code you ship isn't yours: dependencies, base images, build tools. Attackers target that chain. Each defence closes a different gap; turn them on and see which attacks get through.

Dependencies→
Build→
Artifact→
Deploy

Typosquatted package (reqeusts)gets through
Malicious new version of a real dependencystopped
Pinned versions mean a new release isn't pulled in silently.
Known CVE in a base imagegets through
Image built on a laptop and pushedgets through
Image swapped in the registrygets through

1 of 5 stopped

Each defence covers one part of the chain. Signing does nothing unless deploys verify it.

Lockfile + pinned versionsDependenciesDependency and image scanningDependenciesBuilds only in CI, with provenanceBuildSign images (cosign)ArtifactCluster verifies signatures on deployDeploy

Step 4 of 4 · read left to right

1
Control what comes in
Lockfiles pin exact versions; scanners flag known-bad packages and CVEs; review new dependencies.
Dependabot or Renovate for controlled updates.
2
Build in one trusted place
CI builds from source and records provenance (SLSA): which commit, which workflow, which inputs.
Also produce an SBOM.
3
Sign artifacts
Sign images by digest with keys only CI holds (or keyless with Sigstore).
cosign sign registry/app@sha256:…
4
Verify at deploy
An admission policy rejects images that aren't signed by your pipeline. Without this step, signing is decoration.
Kyverno, Sigstore policy-controller.

In production

Tools and technologies

Supply chain security tooling is now standard in CI.

Not tied to one language — use these names when you search docs or design a system.