Software Is a Supply Chain — Start Treating It Like One
Modern software delivery now resembles global manufacturing. If we demand traceability for physical components, we must demand the same for code.
Michael Lieberman
Gaurav Saxena
April 14, 2026
.png)
Software supply chain integrity has moved from technical nuance to board-level concern. As software increasingly powers regulated systems, safety-critical platforms, and revenue-generating infrastructure, organizations must move beyond scanning and toward verifiable production integrity.
In their three-part blog series, Michael Lieberman and Gaurav Saxena highlight their views in shaping the future of software and walk through modern cloud-native tooling including how Sigstore, in-toto, and Kubernetes admission control makes software trust keyless, auditable, machine-verifiable, and enforceable.
Gaurav, a friend of Kusari, is an engineering leader in the field of platform and cloud engineering with over 20 years of experience in the software industry. His technical expertise includes Stream-based architectures, Kubernetes, Service Mesh, Software Supply Chain Security, and Observability.
If an automobile manufacturer released a new vehicle and couldn’t identify where the engine came from, production would stop immediately. There would be questions, audits, root cause investigations, and potential recalls. No one would accept, “It looks fine.”
Yet in software, this is still common practice. Organizations routinely ship container images, deploy services, and promote builds across environments without being able to answer fundamental questions:
- Where did this artifact originate?
- What source commit produced it?
- Which build system created it?
- Has it been modified or tampered with?
- Can we prove any of this cryptographically?
When everything works, those questions stay buried. When something breaks — a vulnerability disclosure, a compromised dependency, a supply chain attack, a regulatory inquiry — teams scramble to reconstruct history after the fact. That model does not scale.
Software Now Resembles Global Manufacturing
Modern applications are assembled from:
- Open source components
- Transitive dependencies
- CI/CD systems with dozens of integrated tools
- Artifacts promoted across multiple environments
Engineering leaders are no longer shipping “code.” They are shipping the accumulated output of hundreds of upstream decisions.
If those decisions are not traceable and verifiable, risk cannot be measured, let alone managed.
Software Needs Manufacturing Discipline
Manufacturing solved this problem decades ago. Critical components come with:
- Verified supplier identity
- Signed documentation
- Shipment logs
- Acceptance criteria
- Batch traceability
If something fails in the field, manufacturers can trace it back to a production batch, supplier lot, or specific process deviation.
Software must now operate with the same discipline.
Industry Momentum: This Is Not a Niche Concern
This shift is not theoretical.
The Open Source Security Foundation (OpenSSF) — a Linux Foundation initiative — developed SLSA (Supply-chain Levels for Software Artifacts) to provide measurable, incrementally adoptable controls for software production integrity. SLSA represents cross-industry consensus on what trustworthy software builds should look like — and how consumers should verify them.
At the same time, Linux Foundation research and industry initiatives around Software Bills of Materials (SBOMs) reflect increasing regulatory and enterprise demand for software transparency. SBOMs improve visibility into components, but visibility alone is insufficient without verifiable provenance.
The industry has moved past awareness to the need for operationalization.
From Documentation to Verification
Historically, software security focused on:
- Vulnerability scanning
- Static analysis
- Compliance checklists
These are necessary controls. But they do not answer a more fundamental question: Can we trust how this artifact was produced?
SLSA reframes the conversation. It introduces progressive levels of assurance around build integrity, provenance generation, and verification.
Critically, SLSA v1.0 makes explicit that provenance must be verified — not merely generated.
Trust that is not enforced is simply documentation.
In Part 2, we’ll examine how the cloud-native ecosystem is solving identity and signing — the foundation of verifiable software supply chains.
Like what you read? Share it with others.
.webp)
.webp)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.jpg)
Previous
No older posts
Next
No newer posts
Want to learn more about Kusari?