Software Supply Chain Glossary
A comprehensive collection of terms, concepts, and definitions related to software supply chain management.
C
Cybersecurity and Infrastructure Security Agency (CISA)
A federal agency responsible for improving cybersecurity across government and critical infrastructure sectors, coordinating national cyber defense, and providing guidance on emerging security threats.
Copyleft Licenses
Open source licenses that require derivative works to be distributed under the same or compatible license terms, ensuring that modifications remain freely available to the community.
P
Permissive Licenses
Open source licenses that impose minimal restrictions on the redistribution and use of software, allowing for incorporation into proprietary products with few requirements beyond attribution.
Provenance
Metadata that describes the origin, creation process, and supply chain journey of a software artifact, enabling verification of its authenticity and integrity.
S
Software Bill of Materials (SBOM)
A formal, machine-readable inventory that lists all components and dependencies included in a software application, providing transparency into the software supply chain.
SCA (Software Composition Analysis)
Tools and methods for identifying, analyzing, and managing third-party and open source components within software applications to mitigate security and compliance risks.
Secrets Management
The processes, practices, and tools for securely handling sensitive information like credentials, tokens, and encryption keys throughout the software development lifecycle and across the supply chain.