Software Supply Chain

Go up to Terms and Definitions

A Software Supply Chain comprises the people, organizations, processes, tools, services, source materials, dependencies, build inputs, build activities, artifacts, distribution mechanisms, and operational relationships involved in producing and delivering software.

The chain begins with the sources and dependencies used to create software and extends through build, test, packaging, signing, storage, distribution, deployment, update, and maintenance activities.

A Software Supply Chain includes both internally controlled and externally supplied elements. External elements may include source repositories, operating-system packages, libraries, machine images, container images, infrastructure providers, build tools, signing services, and distribution services.

Provenance, Traceability, dependency capture, version pinning, verification, and Configuration Management support control of the Software Supply Chain.

set of people, organizations, processes, tools, services, sources, dependencies, activities, artifacts, and relationships involved in producing and delivering software

Generalised from software engineering, cybersecurity, procurement, supply-chain risk management, and DevSecOps usage and specialized for the Crucible architecture and operational model.

A Software Supply Chain includes more than third-party libraries. It includes every controlled or external element that contributes to the production, delivery, deployment, or maintenance of software.

A Software Supply Chain may cross organizational, jurisdictional, network, and accreditation boundaries.

The Software Supply Chain for a hardened machine image includes the operating-system installation media, package repositories, Packer configuration, Ansible collections, compliance content, build host, signing process, image catalog, transfer bundle, and target deployment platform.