Software supply chain

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes the software supply chain?

A Everything used to make and deliver software, such as libraries, tools, suppliers and updates

B Only the code that the app's own developers wrote

2. Most of a modern app is made up of...

A Code written entirely by the app's own team

B Other people's code, such as libraries and frameworks

3. Which of these is part of a software supply chain?

A The colour of the developer's keyboard

B A code library the developers download and use

4. A build system that packages an app is...

A A link in the supply chain that must be trusted

B Outside the supply chain, so it can't be attacked

5. An app has 50 libraries, and 1 is compromised. What is the risk?

A The whole app could be affected, even if the team's own code is safe

B No risk, because the team's own code is safe

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1import requests		AIgnores that other people's libraries are part of the app. A weakness in any outside code can put the whole app at risk.
2pip install flask		BTrusting a link just because it is popular. Every link in the supply chain needs checking, because an attacker can target any one of them.
3Most of an app is other people's code, so the project lists the libraries it depends on		CThe app depends on a library written by someone else, so that library is one link in its software supply chain
4Every link in the supply chain must be trusted, including tools that build and deliver the software		Ddependencies = ['flask', 'requests', 'numpy']
5# I only wrote 5% of this app, so only my code can be a security risk		Etrusted_links = ['library', 'build tool', 'update server']
6# The library is popular, so I trust it without checking		FDownloads a third-party package from an outside supplier and adds it to the project

Definitions

software supply chain

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______ requests print(requests.__version__)

pip _______ requests

requests__2.31.0

libs = ["flask", "requests", "numpy"] print(len(____))

trusted = False if ___ trusted: print("Do not install")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A libs = ["requests", "flask"]

B libs = ["requests", "flask"

C print("Trusted:", lib)

Question 2

A own = 20

B libs = 80

C total = own + libs

D print("Total:" total)

Question 3

A app = {"libs": 40, "own" 5}

B if app["libs"] > app["own"]:

C print("Mostly other code")

Question 4

A for link of supply_chain:

B if not is_trusted(link):

C print("Risk:", link)

Question 5

A pkg = "left-pad"

B ok = ["left-pad", "numpy"]

C if pkg in ok:

D Print("Install", pkg)

Answer Key

Software supply chain

Section A: Quick Questions

A — Everything used to make and deliver software, such as libraries, tools, suppliers and updates

B — Other people's code, such as libraries and frameworks

B — A code library the developers download and use

A — A link in the supply chain that must be trusted

A — The whole app could be affected, even if the team's own code is safe

Section B: Match the Pairs

import requests → The app depends on a library written by someone else, so that library is one link in its software supply chain

pip install flask → Downloads a third-party package from an outside supplier and adds it to the project

Most of an app is other people's code, so the project lists the libraries it depends on → dependencies = ['flask', 'requests', 'numpy']

Every link in the supply chain must be trusted, including tools that build and deliver the software → trusted_links = ['library', 'build tool', 'update server']

# I only wrote 5% of this app, so only my code can be a security risk → Ignores that other people's libraries are part of the app. A weakness in any outside code can put the whole app at risk.

# The library is popular, so I trust it without checking → Trusting a link just because it is popular. Every link in the supply chain needs checking, because an attacker can target any one of them.

Section C: Definitions

software supply chain — Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so every link must be trusted.

Section D: Fill in the Blanks

import requests
print(requests.__version__)

pip install requests

requests==2.31.0

libs = ["flask", "requests", "numpy"]
print(len(libs))

trusted = False
if not trusted:
    print("Do not install")

Section E: Spot the Error

B — The list is missing its closing square bracket. It should end with ] so the list of libraries is complete.

D — The arguments to print() need a comma between them. It should be print("Total:", total).

A — A dictionary key needs a colon before its value. It should be "own": 5.

A — Python loops use the keyword in, not of. It should be for link in supply_chain: so every link gets checked.

D — Python is case-sensitive, so Print is not a function. It should be print("Install", pkg).