Unit 02 of 02
Supply Chain Security
Measuring the layer outside the team's own code with evidence: how many questions the component inventory can answer and which questions fall outside its fields, separating what a signature proves from what it does not and how many outputs become suspect once a key is compromised, how many of a provenance document's fields are independently verifiable and how many are only attested, build environment isolation and scoping permissions counted item by item, how many components a dependency policy flags when run as a rule and how many of those flags are wrong, and findings ranked three times by severity, exploitability, and exposure and how many places the ranking shifts.
Published Updated
Lessons
- 01 Software Bill of Materials A component inventory is measured with a set of questions: how many of twelve questions the inventory's fields can answer, how many go unanswered altogether, how many of the answered ones come with an incomplete field, and how many records the inventory gets wrong at query time depending on how often it is regenerated. 13 min read
- 02 Build Artifact Signing A signature is produced and verified with a real key pair, and what it proves is separated from what it does not: how many of eight claims the signature proves, how many artifacts become suspect retroactively once a key is compromised, and how the signature's coverage and the verifier's testable field diverge as the declaration expands. 15 min read
- 03 Provenance Information The document describing where and how a build was produced is built field by field and reduced to a single number: how many of fourteen fields are independently verifiable, how many remain only attested, how many fields reproducible building turns into evidence, and how many seconds the pipeline loses as the verification threshold rises. 13 min read
- 04 Build Environment Isolation The build environment's permissions are counted item by item: how many items the pipeline accesses, how many it actually needs, how many access pairs remain after isolation and why they remain, how many steps break when the network is closed entirely, and how many secrets become reachable when a change from outside the repository runs. 14 min read
- 05 Dependency Policy The dependency policy is run as a rule set and two numbers are separated: how many of seven rules can run against the inventory's fields, how many components forty-six flags fall on, how many of the flags are real and how many are wrong, how many deviant components no rule ever sees, and how many builds stop in the wrong place once a rule turns into a gate. 11 min read
- 06 Finding Prioritization Findings from every audit in the course are gathered into a single set and ranked three times by severity, exploitability, and exposure; the measure is not the ranking itself but the difference between them: how many pairs reverse order, how many items land in the top ten on all three, how far the most-shifted item moves, and what finite capacity leaves out under which ranking. 13 min read