Complete the supply-chain review

Supply-chain security is the path from contributor to user. A strong step cannot compensate for an untrusted handoff later.

Everything in this course protected one handoff each: dependency selection, source approval, CI execution, artifact creation, publishing, deployment. The review that ties it together is not another checklist per tool. It is tracing one real release across all of them and checking every point where authority changes hands.

Here is why the end-to-end view matters. A project protects source and signs releases, but its desktop updater downloads any file returned by one mutable URL. The final handoff bypasses every earlier control. Reviewed code, clean builds, verified signatures — and the user still executes whatever that URL serves.

Trace one release

Take your latest release and follow it through source approval, dependency resolution, build, artifact, signing, deployment, and update. At each handoff, answer three questions and write the answers down:

Handoff: CI build -> registry
  Identity:   who or what is trusted here?   (release workflow via OIDC)
  Evidence:   what proves the handoff?       (provenance attestation, digest)
  Revocation: how do we cut it off?          (delete trusted publisher config)

Repeat for every arrow in the path. Verify owners, evidence, and revocation at every handoff. The handoffs where you cannot name an identity, point to evidence, or describe revocation are your findings. Record gaps with a concrete next improvement — one sentence each, with an owner.

Fix in the right order

Two kinds of fixes come out of this review. My advice is to remove needless privileged handoffs first — a leftover deploy key, a laptop publish path, a rebuild between staging and production. Deleting a handoff is cheaper and more reliable than defending it. Then add verifiable evidence (provenance, digests, protected identities) where authority must remain.

A review like this is not a one-time event. Rerun it when the pipeline changes shape: a new registry, a new deploy target, a new update mechanism. Each new arrow in the diagram is a new handoff to name, prove, and be able to revoke.

Draw one release path from dependency selection through the user update, naming the identity, evidence, and revocation method at every handoff. Save proof for one complete path. Then replace or compromise one test handoff and show exactly which downstream control detects or blocks it.