Software supply chain

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What is the software supply chain?

A Everything used to make and deliver software, like libraries, tools, build systems and updates

B Only the code that one programmer writes by themselves

2. Which statement about a typical app is true?

A Almost all of it is written by the app's own developers

B Most of it is other people's code, like libraries and frameworks

3. A developer adds a free code library to their app. What have they done to their supply chain?

A Added another link they now have to trust

B Nothing, because libraries are not part of the chain

4. Which of these is part of the software supply chain?

A A build system that packages the app

B The colour of the developer's laptop

5. If one link in the supply chain is weak, what can happen?

A Only the weak link is affected and nothing else

B Every app that depends on it can be put at risk

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1npm install left-pad		Abuild: run-tool compile --all
2import requests		BUses a third-party library in your program, showing that most of an app is other people's code
3Your app depends on a library, so you trust whoever made it		CAdds a code library written by someone else to your project, so it becomes part of your software supply chain
4Build systems and tools are part of the supply chain, not just the code you write		DMost apps are built mostly from other people's code like libraries and tools, so the supply chain always matters.
5My app is 100% my own code, so the supply chain does not matter.		Edependencies: { "chart-lib": "2.1.0" }
6Only the final app is in the supply chain; libraries and updates are not.		FThe supply chain includes everything used to make and deliver software: libraries, tools, build systems, suppliers and updates.

Definitions

software supply chain

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______ requests print(requests.__version__)

pip _______ requests

{ "____________": {"left-pad": "1.3.0"} }

npm ______ express

own = 500 libs = 9500 share = libs _ 100 / (own + libs)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A my_code = 200

B lib_code = 800

C total = my_code + lib_code

D lib_share = my_code / total

Question 2

A chain = ["lib", "tool"]

B for link in chain[:1]:

C check(link)

D print("All links checked")

Question 3

A deps = ["flask", "numpy"]

B count = len(deps) - 1

C print(count, "dependencies")

Question 4

A app = my_code

B build = make(app)

C release = deliver(build)

D print(release)

Question 5

A update_ok = True

B if update_ok:

C install(update)

D else:

E skip(update)

Answer Key

Software supply chain

Section A: Quick Questions

A — Everything used to make and deliver software, like libraries, tools, build systems and updates

B — Most of it is other people's code, like libraries and frameworks

A — Added another link they now have to trust

A — A build system that packages the app

B — Every app that depends on it can be put at risk

Section B: Match the Pairs

npm install left-pad → Adds a code library written by someone else to your project, so it becomes part of your software supply chain

import requests → Uses a third-party library in your program, showing that most of an app is other people's code

Your app depends on a library, so you trust whoever made it → dependencies: { "chart-lib": "2.1.0" }

Build systems and tools are part of the supply chain, not just the code you write → build: run-tool compile --all

My app is 100% my own code, so the supply chain does not matter. → Most apps are built mostly from other people's code like libraries and tools, so the supply chain always matters.

Only the final app is in the supply chain; libraries and updates are not. → The supply chain includes everything used to make and deliver software: libraries, tools, build systems, suppliers and updates.

Section C: Definitions

software supply chain — Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

Section D: Fill in the Blanks

import requests
print(requests.__version__)

pip install requests

{
  "dependencies": {"left-pad": "1.3.0"}
}

npm update express

own = 500
libs = 9500
share = libs * 100 / (own + libs)

Section E: Spot the Error

D — This works out your own share of the code, not the library share. It should divide lib_code by total, because most of an app is other people's code.

B — chain[:1] only loops over the first link. Every link in the supply chain must be trusted and checked, so the loop should use the whole chain.

B — Subtracting 1 undercounts the dependencies. You need to know about every library you rely on, so it should be count = len(deps).

A — This leaves out the libraries. An app is mostly other people's code, so it should be app = my_code + libraries.

A — Setting update_ok to True means the update is never verified, so it is trusted blindly. It should call verify(update) first.