Identify dependency, build, artifact, and maintainer risks.
Use lockfiles, provenance, signing, and review.
Respond to vulnerable or compromised dependencies.
A software supply chain includes source, dependencies, package registries, build agents, artifacts, deployment, and maintainers. A vulnerability scan is useful but incomplete: verify reachability, exploitability, transitive dependencies, build integrity, and runtime exposure.
Pin versions, review updates, protect build identities, generate a software bill of materials, sign artifacts, and verify signatures at deployment. Emergency response needs inventory and a way to revoke or replace affected artifacts.
Exercises
Map dependencies in a web service.
Design build-agent permissions.
Write response steps for a compromised package.
Self-check
What is an SBOM?
Why sign artifacts?
Why is a scanner not enough?
Self-Check Quiz
1. What does provenance describe?
AnswerHow an artifact was produced, from identified source and dependencies through a controlled build.
2. What does pinning reduce?
AnswerUnexpected dependency changes and some forms of supply-chain drift.
Homework
Create a supply-chain security checklist.
Design SBOM and artifact verification flow.
Plan a vulnerable-dependency response.
Sample answerInventory dependencies, lock versions, review updates, scan and assess reachability, protect build identities, generate SBOM and provenance, sign artifacts, verify at deployment, and rebuild or revoke affected releases when compromise is confirmed.