Software Supply Chain Security

Software supply chain security studies how to keep software trustworthy from component selection and development through builds, distribution, and deployment. Common approaches include software and AI bills of materials, provenance and signing, dependency scanning, graph-based vulnerability analysis, behavioral sandboxing, and CI/CD controls; newer work also examines coding agents, prompt injection, package hallucinations, and model updates. Benchmarks and audits increasingly use real repositories, package ecosystems, container images, and production-like agent workflows, combining static evidence with runtime behavior and repository context. A central challenge is that inventories and scanners can be incomplete or noisy, and available trust signals may go unchecked, so assurance must connect verifiable provenance to context-aware analysis and enforced controls.