moai-ref-supply-chain

# Software Supply-Chain Defensive Security Reference Defensive practitioner reference for hardening a software supply chain — the chain from source, through build, to the artifact a consumer installs. Every section is framed as defense, hardening, detection, or verification: it describes the weakness, how to detect it, and how to prevent it, never how to exploit it. AI/LLM-specific supply-chain concerns (model and training-data provenance) live in `moai-ref-llm-security`; web-application vulnerabilities live in `moai-ref-owasp-checklist`. ## Target Use Apply when building, releasing, or consuming software components. The threat model is an untrusted supply chain: any dependency you pull, any build step you run, and any artifact you ship may have been substituted, tampered with, or impersonated. The defenses below establish provenance (where did this come from?), integrity (has it been altered?), and hygiene (is this the component I meant to use?). ## The Supply-Chain Trust Boundaries The core defensive insight: each hand-off in the chain is a boundary where a component can be substituted or tampered. Establish provenance and verify integrity at every hand-off. | Boundary | Substitution / tamper risk | Primary defense | |----------|----------------------------|-----------------| | Source resolution (name → package) | Dependency confusion, typosquatting | Namespace scoping, install-time verification, name allowlist | | Dependency download | Compromised registry, MITM | Lo...