This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques

翻译：本文系统化整理了关于安全软件供应链模式的知识。它识别了软件供应链攻击的四个阶段，并提出了对安全供应链至关重要的三个安全属性：透明度、有效性和隔离性。本文描述了当前的安全方法，并将其映射到所提出的安全属性，包括研究思路和实践中的供应链案例研究。文章讨论了现有方法相对于已知攻击的优势与不足，并详细阐述了为确保软件供应链安全而提出的各种安全框架。最后，本文重点指出了以参与者和操作为中心的供应链安全技术中存在的潜在不足。