EVERYTHING.md

The Software Supply Chain Stages

People	Local Reqs	Source Code	Integration	Deployment	Runtime	Hardware	DNS	Services	Cloud
Developers	IDE	Languages	SCM providers	Build solutions	Servers	Embedded PC	URL	SaaS solutions	CDN
QA team	SCV	Frameworks	Pull requests	Deployment platforms	Operating systems	PCB	hostname	Third party APIs	Cloud services
DevOps team	Local tests	Libraries	Secrets mgmt	Releases	Webservers	USB dongle		Payment gateways
Package Maintainers	Git repos	Package Managers	Git repos	Functional tests	Application servers	GPU/CPU		Identity Providers
	Page Builders	Packages		Security tests	Web engines			Analytics
		Open source		API test frameworks	Databases			Proxies
		Proprietary Code		Unit tests
People	Local Reqs	Source Code	Integration	Deployment	Runtime	Hardware	DNS	Services	Cloud

People

These are the individuals or teams of people that are needed to write, build and deploy software.

What's in scope?

• Software engineers
• QA team
• DevOps team

Examples

Developers

  

Local Requirements

This includes any local applications, configurations, or other dependencies that are needed to for the people building software to successfully do their job.

What's in scope?

• IDE
• VCS tools
• Local tests

Examples

IDE

VCS Tools

Local tests

Linting, static analysis, software composition analysis

  

Source Code

This includes any software that is needed to successfully write, build or deploy an application.

What's in scope?

• Programming languages
• Frameworks
• Libraries
• Open source components
• Proprietary code

Examples

Programming Languages

Frameworks & libraries

Continuous Integration

Continuous integration (CI) is the process of automatically integrating code changes from multiple contributors into a single software project. This is an important DevOps best practice that enables developers to frequently merge code changes into a central repository for testing before deployment. Automated tools are used to check that the new code is correct before integration.

What's in scope?

• SCM providers
• Pull requests

Examples

SCM Providers

Continuous deployment

Continuous delivery is an extension of continuous integration that automatically deploys all code changes to a testing and/or production environment after the build stage. This means that in addition to automated testing, you have an automated release process, and can deploy your application at any time by clicking a button.

What's in scope?

• Build servers
• Deployment platforms
• Security tests
• Functional tests

Examples

Bamboo, Selenium, Semgrep, SecureStack

  

Runtime

The web application runtime is the environment in which a web application is executed. It typically includes the web server, the application server, and other necessary components such as databases, messaging systems, and caching mechanisms. The runtime is responsible for managing the application's resources, handling incoming requests, and returning responses to users.

What's in scope

• Operating systems
• Webservers
• Application servers
• Content management systems
• Web runtime engines
• Databases
• Containers, AMIs & golden images

Examples

Operating systems

Webservers

Application servers

Content management systems

Clarity, Kentico, Sharepoint, Adobe Experience Manager

Web runtime

Node.js, WebKit, Chrome, V8

Databases

Containers, AMIs & Golden Images

  

Hardware

This includes any specific or customized piece of hardware for this application to run.

What's in scope?

• Proprietary devices
• Dedicated servers

Examples

Embedded devices, custom PCBs, GPUs

  

DNS

This includes any hostnames, or other DNS entries that any application needs.

What's in scope?

• DNS

Examples

app.example.org

  

Services

This refers to the process of identifying and describing the external services that a application relies on in order to function properly. These third-party services can include anything from authentication and authorization services to payment processing and analytics tools.

What's in scope?

• third party SaaS solutions
• third party APIs or data
• payment processors/gateways
• identity providers
• analytics & tracking

Examples

Payment gateways & processors

SaaS solutions examples

Analytics & tracking examples

  

Cloud resources

Cloud native resources refer to the tools, technologies, and infrastructure required to develop, deploy, and manage applications that are designed to run in a cloud environment. These resources typically include containerization platforms, orchestration frameworks, serverless computing, and other cloud-specific technologies.

What's in scope?

• PaaS
• CDN
• Cloud hosting providers
• Cloud native resources

Examples

PaaS Examples

CDN Examples

Cloud hosting providers

Cloud Native Services

DynamoDB, Azure Functions, Microsoft Power Apps, Azure Cosmos, Azure Application Gateway, AWS Elastic Load Balancer, AWS Certificate Manager