Software Supply Chain Security Getting Serious Traction

Two threads today touch supply chain integrity from different angles. The in-toto framework thread covers a cryptographic attestation system for securing the steps in a software build pipeline, with Red Hat cited as doing real work here. Separately, npm-scan appeared in the story list targeting the npm ecosystem specifically.

The pattern: supply chain security has moved from an abstract concern to an active engineering problem, driven by incidents like the XZ Utils backdoor and SolarWinds. The in-toto discussion included pushback that the spec is over-engineered, which is a fair critique of a lot of security tooling but does not change the underlying need.

The counterpoint from the thread is that most teams will not implement something as heavyweight as in-toto. The gap between what is secure and what teams will actually adopt remains wide, and that gap is where real attacks happen.