Theory

Theory: Supply Chain is Trust in What You Did Not Write

Git signatures, SBOMs, dependency scans, and secret detection are layers on provenance. A platform hardens the perimeter; it cannot see an unsigned curl | bash in a Dockerfile unless you look.

Invariants

1. Verify on the server what ch 20 taught on the client.
2. SBOM is a graph of what you shipped, not a scanner by itself.
3. A supply-chain incident is usually a trusted path (CI, dep, maintainer).

source (signed) → CI (OIDC) → registry (digest) → runtime
           SBOM + scan attach evidence to this path

What can break

• Signing commits but not pinning Actions by digest.

How to read this chapter

Server-side git security, scanning, SBOM, secrets, incidents, hardening.