← ACARA Digital Technologies Years 9–10

Software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 74, WA Computer Science ATAR Year 11 — Cyber Security — Module 58

Understanding Software supply chain in ACARA Digital Technologies Years 9–10

What it does: A dependency list shows how much of an app is built from outside libraries rather than the developer's own code. The supply chain covers libraries, build systems and updates, and each of these links must be trusted. Developers reuse lots of libraries and tools, so most of an app is code someone else wrote. A weak link can affect everything built on it, no matter how careful the team was with its own code. The chain is only as strong as its weakest link. Updates are a delivery link. If one is tampered with, many users can be affected. Reusing code is useful, but you are trusting the people who made it.

Common mistakes: The list is missing its closing square bracket. It should end with ] so the list of libraries is complete. The arguments to print() need a comma between them. It should be print("Total:", total).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Software supply chain to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which best describes the software supply chain?

Only the code that the app's own developers wroteEverything used to make and deliver software, such as libraries, tools, suppliers and updates

Matches

# I only wrote 5% of this app, so only my code can be a security risk

↓

Ignores that other people's libraries are part of the app. A weakness in any outside code can put the whole app at risk.

Applying

Meanings

Term

software supply chain

Meaning

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

Practice

const supplyChain = ["library", "tool", "update"];

Testing

Gaps

requests

Check Answer

Spots

1libs = ["requests", "flask"]

2libs = ["requests", "flask"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes the software supply chain?

A. Everything used to make and deliver software, such as libraries, tools, suppliers and updates ✓

B. Only the code that the app's own developers wrote

The supply chain covers every part used to build and deliver software, not just the code the team wrote.

2. Most of a modern app is made up of...

A. Code written entirely by the app's own team

B. Other people's code, such as libraries and frameworks ✓

Developers reuse lots of libraries and tools, so most of an app is code someone else wrote.

3. Which of these is part of a software supply chain?

A. The colour of the developer's keyboard

B. A code library the developers download and use ✓

Libraries are building blocks of an app, so they are a link in the supply chain.

4. A build system that packages an app is...

A. A link in the supply chain that must be trusted ✓

B. Outside the supply chain, so it can't be attacked

Build systems and tools are part of the chain. If attackers get into one, they can change the app.

5. An app has 50 libraries, and 1 is compromised. What is the risk?

A. The whole app could be affected, even if the team's own code is safe ✓

B. No risk, because the team's own code is safe

A weak link can affect everything built on it, no matter how careful the team was with its own code.

Match the Pairs

import requests → The app depends on a library written by someone else, so that library is one link in its software supply chain

pip install flask → Downloads a third-party package from an outside supplier and adds it to the project

Most of an app is other people's code, so the project lists the libraries it depends on → dependencies = ['flask', 'requests', 'numpy']

Every link in the supply chain must be trusted, including tools that build and deliver the software → trusted_links = ['library', 'build tool', 'update server']

# I only wrote 5% of this app, so only my code can be a security risk → Ignores that other people's libraries are part of the app. A weakness in any outside code can put the whole app at risk.

# The library is popular, so I trust it without checking → Trusting a link just because it is popular. Every link in the supply chain needs checking, because an attacker can target any one of them.

Key Term

software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

Fill in the Blanks

1. import requests print(requests.__version__)

Hint: Type the Python keyword that brings someone else's code library into your program.

2. pip install requests

Hint: Type the pip command word that downloads a library from a supplier into your project.

3. requests==2.31.0

Hint: Type the operator that pins one exact version of a dependency so you know what you are trusting.

4. libs = ["flask", "requests", "numpy"] print(len(libs))

Hint: Type the variable name that holds the list of other people's libraries, to count how many your app relies on.

5. trusted = False if not trusted: print("Do not install")

Hint: Type the keyword that reverses a condition, so the warning runs when a link in the chain is not trusted.

Spot the Error

Question 1

A libs = ["requests", "flask"]

B libs = ["requests", "flask"

C print("Trusted:", lib)

Line B — The list is missing its closing square bracket. It should end with ] so the list of libraries is complete.

Question 2

A own = 20

B libs = 80

C total = own + libs

D print("Total:" total)

Line D — The arguments to print() need a comma between them. It should be print("Total:", total).

Question 3

A app = {"libs": 40, "own" 5}

B if app["libs"] > app["own"]:

C print("Mostly other code")

Line A — A dictionary key needs a colon before its value. It should be "own": 5.

Question 4

A for link of supply_chain:

B if not is_trusted(link):

C print("Risk:", link)

Line A — Python loops use the keyword in, not of. It should be for link in supply_chain: so every link gets checked.

Question 5

A pkg = "left-pad"

B ok = ["left-pad", "numpy"]

C if pkg in ok:

D Print("Install", pkg)

Line D — Python is case-sensitive, so Print is not a function. It should be print("Install", pkg).

Student with a class code? Join your class →