| Both sides previous revision Previous revision | |
| public:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity to public:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity nick_dido | public:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido |
|---|
| ====== Supply-Chain Integrity ====== | ====== Supply-Chain Integrity ====== |
| |
| [[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] | [[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] |
| |
| ===== Discussion ===== | ===== Discussion ===== |
| Supply-Chain Integrity is the condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration. | Supply-Chain Integrity is the condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration. |
| |
| The condition applies to source material, dependencies, tools, build processes, artifacts, manifests, signatures, evidence, transfer mechanisms, repositories, and associated [[private:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]]. | The condition applies to source material, dependencies, tools, build processes, artifacts, manifests, signatures, evidence, transfer mechanisms, repositories, and associated [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]]. |
| |
| Supply-Chain Integrity depends on controls such as [[private:99_annexes:annex-b-terms-and-definitions:v:version_pinning|Version Pinning]], integrity verification, digital signatures, controlled repositories, change approval, access control, traceable transformations, and preservation of authoritative records. | Supply-Chain Integrity depends on controls such as [[public:99_annexes:annex-b-terms-and-definitions:v:version_pinning|Version Pinning]], integrity verification, digital signatures, controlled repositories, change approval, access control, traceable transformations, and preservation of authoritative records. |
| |
| Within Crucible, Supply-Chain Integrity supports confidence that the artifacts built, transferred, imported, and deployed correspond to the approved inputs and controlled processes recorded for them. | Within Crucible, Supply-Chain Integrity supports confidence that the artifacts built, transferred, imported, and deployed correspond to the approved inputs and controlled processes recorded for them. |
| Supply-Chain Integrity does not establish that every supply-chain element is secure, defect-free, compliant, or suitable for its intended use. It establishes confidence that the elements and their relationships have not changed outside the applicable controls. | Supply-Chain Integrity does not establish that every supply-chain element is secure, defect-free, compliant, or suitable for its intended use. It establishes confidence that the elements and their relationships have not changed outside the applicable controls. |
| |
| Integrity verification should apply both before and after transfer across an organizational, network, or [[private:99_annexes:annex-b-terms-and-definitions:a:air_gap|Air Gap]] boundary. | Integrity verification should apply both before and after transfer across an organizational, network, or [[public:99_annexes:annex-b-terms-and-definitions:a:air_gap|Air Gap]] boundary. |
| |
| ===== Example ===== | ===== Example ===== |