← Years 9–10 Digital Systems

Software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 64, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 39

Understanding Software supply chain in Years 9–10 Digital Systems

What it does: A dependency list shows the outside code your app relies on, and each one is a link in the chain you trust. Build tools turn code into the finished app, so if they were tampered with the final software could be affected. Modern apps are built from lots of libraries and tools made by others, so your code is mostly other people's code. Every library becomes a link in the chain. If it is unsafe, the app can be unsafe too. Build systems, tools, libraries, suppliers and updates are all links in the chain. Because apps depend on each link, a problem in one can spread to everything built on it.

Common mistakes: This works out your own share of the code, not the library share. It should divide lib_code by total, because most of an app is other people's code. chain[:1] only loops over the first link. Every link in the supply chain must be trusted and checked, so the loop should use the whole chain.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Software supply chain to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What is the software supply chain?

Only the code that one programmer writes by themselvesEverything used to make and deliver software, like libraries, tools, build systems and updates

Matches

My app is 100% my own code, so the supply chain does not matter.

↓

Most apps are built mostly from other people's code like libraries and tools, so the supply chain always matters.

Applying

Meanings

Term

software supply chain

Meaning

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

Practice

{

Testing

Gaps

requests

Check Answer

Spots

3total = my_code + lib_code

4lib_share = my_code / total

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What is the software supply chain?

A. Everything used to make and deliver software, like libraries, tools, build systems and updates ✓

B. Only the code that one programmer writes by themselves

The software supply chain covers every part involved in making and delivering software, not just your own code.

2. Which statement about a typical app is true?

A. Almost all of it is written by the app's own developers

B. Most of it is other people's code, like libraries and frameworks ✓

Modern apps are built from lots of libraries and tools made by others, so your code is mostly other people's code.

3. A developer adds a free code library to their app. What have they done to their supply chain?

A. Added another link they now have to trust ✓

B. Nothing, because libraries are not part of the chain

Every library becomes a link in the chain. If it is unsafe, the app can be unsafe too.

4. Which of these is part of the software supply chain?

A. A build system that packages the app ✓

B. The colour of the developer's laptop

Build systems, tools, libraries, suppliers and updates are all links in the chain.

5. If one link in the supply chain is weak, what can happen?

A. Only the weak link is affected and nothing else

B. Every app that depends on it can be put at risk ✓

Because apps depend on each link, a problem in one can spread to everything built on it.

Match the Pairs

npm install left-pad → Adds a code library written by someone else to your project, so it becomes part of your software supply chain

import requests → Uses a third-party library in your program, showing that most of an app is other people's code

Your app depends on a library, so you trust whoever made it → dependencies: { "chart-lib": "2.1.0" }

Build systems and tools are part of the supply chain, not just the code you write → build: run-tool compile --all

My app is 100% my own code, so the supply chain does not matter. → Most apps are built mostly from other people's code like libraries and tools, so the supply chain always matters.

Only the final app is in the supply chain; libraries and updates are not. → The supply chain includes everything used to make and deliver software: libraries, tools, build systems, suppliers and updates.

Key Term

software supply chain

Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

Fill in the Blanks

1. import requests print(requests.__version__)

Hint: Type the Python keyword that brings someone else's library into your program.

2. pip install requests

Hint: Type the pip command word that downloads a library from a supplier.

3. { "dependencies": {"left-pad": "1.3.0"} }

Hint: Type the key name for the list of outside libraries your project needs.

4. npm update express

Hint: Type the npm command word that fetches newer versions of a library, which is one link in the chain.

5. own = 500 libs = 9500 share = libs * 100 / (own + libs)

Hint: Type the operator that scales the library lines up so the share becomes a percentage.

Spot the Error

Question 1

A my_code = 200

B lib_code = 800

C total = my_code + lib_code

D lib_share = my_code / total

Line D — This works out your own share of the code, not the library share. It should divide lib_code by total, because most of an app is other people's code.

Question 2

A chain = ["lib", "tool"]

B for link in chain[:1]:

C check(link)

D print("All links checked")

Line B — chain[:1] only loops over the first link. Every link in the supply chain must be trusted and checked, so the loop should use the whole chain.

Question 3

A deps = ["flask", "numpy"]

B count = len(deps) - 1

C print(count, "dependencies")

Line B — Subtracting 1 undercounts the dependencies. You need to know about every library you rely on, so it should be count = len(deps).

Question 4

A app = my_code

B build = make(app)

C release = deliver(build)

D print(release)

Line A — This leaves out the libraries. An app is mostly other people's code, so it should be app = my_code + libraries.

Question 5

A update_ok = True

B if update_ok:

C install(update)

D else:

E skip(update)

Line A — Setting update_ok to True means the update is never verified, so it is trusted blindly. It should call verify(update) first.

Student with a class code? Join your class →