Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:s:software_supply_chain [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1
+++ public:99_annexes:annex-b-terms-and-definitions:s:software_supply_chain [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
+====== Software Supply Chain ======
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+===== Discussion =====
+A Software Supply Chain comprises the people, organizations, processes, tools, services, source materials, dependencies, build inputs, build activities, artifacts, distribution mechanisms, and operational relationships involved in producing and delivering software.
+The chain begins with the sources and dependencies used to create software and extends through build, test, packaging, signing, storage, distribution, deployment, update, and maintenance activities.
+A Software Supply Chain includes both internally controlled and externally supplied elements. External elements may include source repositories, operating-system packages, libraries, machine images, container images, infrastructure providers, build tools, signing services, and distribution services.
+[[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]], [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], dependency capture, version pinning, verification, and [[public:99_annexes:annex-b-terms-and-definitions:c:configuration_management|Configuration Management]] support control of the Software Supply Chain.
+===== Definition =====
+//set of people, organizations, processes, tools, services, sources, dependencies, activities, artifacts, and relationships involved in producing and delivering software//
+===== Source =====
+Generalised from software engineering, cybersecurity, procurement, supply-chain risk management, and DevSecOps usage and specialized for the Crucible architecture and operational model.
+===== Note =====
+A Software Supply Chain includes more than third-party libraries. It includes every controlled or external element that contributes to the production, delivery, deployment, or maintenance of software.
+A Software Supply Chain may cross organizational, jurisdictional, network, and accreditation boundaries.
+===== Example =====
+The Software Supply Chain for a hardened machine image includes the operating-system installation media, package repositories, Packer configuration, Ansible collections, compliance content, build host, signing process, image catalog, transfer bundle, and target deployment platform.
+----
+<WRAP centeralign>
+© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
+</WRAP>