Software Supply Chain Glossary
A comprehensive collection of terms, concepts, and definitions related to software supply chain management.
A
Artifact Repository
A specialized storage system that manages and organizes software packages, binaries, and dependencies throughout the software development lifecycle.
Attestation
A digitally signed statement or evidence about software artifacts that verifies specific properties, origins, or processes related to the software supply chain, enhancing trust and transparency.
Authentication
The process of verifying the identity of a user, system, or entity attempting to access a resource, ensuring that only authorized parties can gain access to protected systems and data.
C
Container Bill of Materials (CBOM)
A structured inventory that documents all components, dependencies, and configuration details within a container image, enabling enhanced visibility and security throughout the container lifecycle.
Cybersecurity and Infrastructure Security Agency (CISA)
A federal agency responsible for improving cybersecurity across government and critical infrastructure sectors, coordinating national cyber defense, and providing guidance on emerging security threats.
Code Signing
The process of digitally signing executables and software packages to verify the author's identity and ensure the code hasn't been altered or corrupted since signing.
Cryptography
The practice and study of techniques for securing communication and data through the use of mathematical algorithms, enabling confidentiality, integrity, authentication, and non-repudiation in software systems.
D
Dependency Confusion
A software supply chain attack where malicious packages with the same name as internal dependencies are published to public repositories, tricking build systems into using the malicious version.
DevSecOps
An approach to culture, automation, and platform design that integrates security as a shared responsibility throughout the entire IT lifecycle, from initial development through production deployment and beyond.
Q
Quantum Computing Security
The field addressing cryptographic vulnerabilities and cybersecurity challenges posed by quantum computers, focusing on post-quantum cryptography and mitigations for quantum threats to software supply chains.
Quantum Computing
A form of computing that harnesses quantum mechanical phenomena to perform calculations, potentially threatening current cryptographic systems while enabling new approaches to secure communications.
S
Software Bill of Materials (SBOM)
A formal, machine-readable inventory that lists all components and dependencies included in a software application, providing transparency into the software supply chain.
SCA (Software Composition Analysis)
Tools and methods for identifying, analyzing, and managing third-party and open source components within software applications to mitigate security and compliance risks.
Secrets Management
The processes, practices, and tools for securely handling sensitive information like credentials, tokens, and encryption keys throughout the software development lifecycle and across the supply chain.
Sigstore
An open-source project providing a standard way to sign, verify, and protect software artifacts without managing long-term cryptographic keys.
SLSA (Supply-chain Levels for Software Artifacts)
A security framework that defines graduated levels of software supply chain security, helping organizations incrementally improve their security posture.
Software Supply Chain
The full lifecycle and pipeline involved in developing, building, packaging, distributing, and deploying software—including dependencies, tools, infrastructure, and people.
Supply Chain Attack
A cyberattack that targets the less-secure elements in the software supply chain to compromise the intended target.
T
Transitive Dependency
A dependency that is not directly imported by a project but is required by one of the project's direct dependencies.
Typosquatting
A software supply chain attack where malicious packages with names similar to popular dependencies are published, exploiting common typing errors to trick developers into installing them.