Skip to content

Latest commit

 

History

History
254 lines (146 loc) · 13.9 KB

EVERYTHING.md

File metadata and controls

254 lines (146 loc) · 13.9 KB
Raw

The Software Supply Chain Stages

People Local Reqs Source Code Integration Deployment Runtime Hardware DNS Services Cloud
Developers IDE Languages SCM providers Build solutions Servers Embedded PC URL SaaS solutions CDN
QA team SCV Frameworks Pull requests Deployment platforms Operating systems PCB hostname Third party APIs Cloud services
DevOps team Local tests Libraries Secrets mgmt Releases Webservers USB dongle Payment gateways
Package Maintainers Git repos Package Managers Git repos Functional tests Application servers GPU/CPU Identity Providers
Page Builders Packages Security tests Web engines Analytics
Open source API test frameworks Databases Proxies
Proprietary Code Unit tests
People Local Reqs Source Code Integration Deployment Runtime Hardware DNS Services Cloud

People

These are the individuals or teams of people that are needed to write, build and deploy software.

What's in scope?

  • Software engineers
  • QA team
  • DevOps team

Examples

Developers

collaborators-github

  

Local Requirements

This includes any local applications, configurations, or other dependencies that are needed to for the people building software to successfully do their job.

What's in scope?

  • IDE
  • VCS tools
  • Local tests

Examples

IDE

VCS Tools

Local tests

Linting, static analysis, software composition analysis

  

Source Code

This includes any software that is needed to successfully write, build or deploy an application.

What's in scope?

  • Programming languages
  • Frameworks
  • Libraries
  • Open source components
  • Proprietary code

Examples

Programming Languages

Frameworks & libraries

Continuous Integration

Continuous integration (CI) is the process of automatically integrating code changes from multiple contributors into a single software project. This is an important DevOps best practice that enables developers to frequently merge code changes into a central repository for testing before deployment. Automated tools are used to check that the new code is correct before integration.

What's in scope?

  • SCM providers
  • Pull requests

Examples

SCM Providers

Continuous deployment

Continuous delivery is an extension of continuous integration that automatically deploys all code changes to a testing and/or production environment after the build stage. This means that in addition to automated testing, you have an automated release process, and can deploy your application at any time by clicking a button.

What's in scope?

  • Build servers
  • Deployment platforms
  • Security tests
  • Functional tests

Examples

Bamboo, Selenium, Semgrep, SecureStack

  

Runtime

The web application runtime is the environment in which a web application is executed. It typically includes the web server, the application server, and other necessary components such as databases, messaging systems, and caching mechanisms. The runtime is responsible for managing the application's resources, handling incoming requests, and returning responses to users.

What's in scope

  • Operating systems
  • Webservers
  • Application servers
  • Content management systems
  • Web runtime engines
  • Databases
  • Containers, AMIs & golden images

Examples

Operating systems

Webservers

Application servers

Content management systems

Clarity, Kentico, Sharepoint, Adobe Experience Manager

Web runtime

Node.js, WebKit, Chrome, V8

Databases

Containers, AMIs & Golden Images

  

Hardware

This includes any specific or customized piece of hardware for this application to run.

What's in scope?

  • Proprietary devices
  • Dedicated servers

Examples

Embedded devices, custom PCBs, GPUs

  

DNS

This includes any hostnames, or other DNS entries that any application needs.

What's in scope?

  • DNS

Examples

app.example.org

  

Services

This refers to the process of identifying and describing the external services that a application relies on in order to function properly. These third-party services can include anything from authentication and authorization services to payment processing and analytics tools.

What's in scope?

  • third party SaaS solutions
  • third party APIs or data
  • payment processors/gateways
  • identity providers
  • analytics & tracking

Examples

Payment gateways & processors

SaaS solutions examples

Analytics & tracking examples

  

Cloud resources

Cloud native resources refer to the tools, technologies, and infrastructure required to develop, deploy, and manage applications that are designed to run in a cloud environment. These resources typically include containerization platforms, orchestration frameworks, serverless computing, and other cloud-specific technologies.

What's in scope?

  • PaaS
  • CDN
  • Cloud hosting providers
  • Cloud native resources

Examples

PaaS Examples

CDN Examples

Cloud hosting providers

Cloud Native Services

DynamoDB, Azure Functions, Microsoft Power Apps, Azure Cosmos, Azure Application Gateway, AWS Elastic Load Balancer, AWS Certificate Manager