Software Supply Chain Security Roadmap

Begin with the artifact lifecycle and make trust decisions explicit before adding tools.

• Trace source, maintainer, package source, build, registry, deployment, and consumer boundaries
• Model source compromise, malicious packages, dependency confusion, stolen identity, and artifact substitution
• Evaluate dependencies with OpenSSF Scorecard check details and use-case context
• Require approved registries, namespaces, lock or integrity files, ownership, and purpose
• Review direct and transitive dependency changes on every pull request
• Use Dependabot or equivalent renovation for small, frequent, reviewable updates
• Assess maintenance, security policy, release practices, licenses, vulnerabilities, and removal options
• Protect source, workflow, lock, ownership, and policy changes with review and status checks

Build an artifact and component inventory that responders can actually use.

• Understand SPDX as an international open standard and CycloneDX as an extensible BOM model
• Select a format and version based on consumer interoperability rather than branding
• Generate against the final artifact or reconcile source, build, and image inventories
• Record root subject, hashes, identifiers, dependency relationships, generator, and completeness
• Bind or attest each SBOM to an immutable artifact digest
• Validate syntax, schema, expected components, freshness, and data-quality status
• Triage vulnerability matches with version confirmation, exposure, exploitability, fixes, owner, and deadline
• Exercise secret detection, invalidation, impact assessment, rotation, cleanup, and prevention with a fake token

Learn what each kind of evidence proves, then bind it to the exact artifact consumers receive.

• Use SHA-256 digests as immutable artifact identity and treat tags as mutable pointers
• Distinguish signature integrity and signer authentication from vulnerability or quality claims
• Sign with Cosign keyless identity using an approved OIDC release context
• Verify certificate identity or pattern, OIDC issuer, claims, transparency or bundle evidence, and digest
• Understand attestations as authenticated predicates about named subjects
• Produce and verify SLSA provenance for source, revision, builder, workflow, and build inputs
• Authorize predicate type and claim values rather than accepting any valid attestation
• Build independently, compare digests, and remove hidden timestamps, ordering, network, and tool inputs

Separate the identity that produces evidence from the identity that verifies and deploys it.

• Set workflow permissions to read-only or none and grant narrow job-level capabilities
• Constrain OIDC issuer, audience, repository, protected ref or environment, and cloud role
• Keep untrusted pull-request code out of privileged release and signing contexts
• Pin reviewed actions, tools, base images, and package inputs to immutable identifiers
• Use ephemeral isolated builders with declared inputs, controlled networks, and verified destruction
• Separate registry pull, publish, promote, quarantine, and delete roles
• Require SBOM, provenance, signature identity, scans, and approved exceptions for promotion
• Resolve, verify, authorize, and deploy one exact digest through an independent gate

Scale controls through transparent policy and prove the organization can contain and recover from compromise.

• Map outcomes and evidence to NIST SSDF Prepare, Protect, Produce, and Respond practices
• Use criticality tiers and distinguish fail, missing, stale, malformed, and unavailable evidence
• Roll policy from report to warning to enforcement with tests, owners, and rollback
• Require exceptions to name exact scope, rationale, controls, owner, approver, evidence, and expiry
• Link artifact digests to source, builder, SBOM, provenance, registry, deployments, consumers, and owners
• Exercise compromised dependency, leaked secret, moved tag, and compromised builder scenarios
• Measure verified-release coverage, remediation age, SBOM freshness, exception health, and response time
• Contain publishing, preserve evidence, scope digests, notify consumers, rebuild trusted artifacts, and verify recovery