Open RAN enables third-party xApps and rApps to be onboarded and updated at operational cadence, creating a software supply chain that spans developers, CI systems, registries, onboarding pipelines, and runtime enforcement points. This preprint proposes a zero-trust supply-chain assurance rubric for O-RAN RIC applications. It makes three contributions: first, an app-centric lifecycle threat model for RIC applications across build, signing, publication, onboarding, runtime, and update or rollback stages; second, a WG11-aligned threat-control-evidence mapping that relates lifecycle threats to O-RAN security baselines and complementary supply-chain evidence; and third, an operator-facing assurance profile that combines secure software development practices, SBOM transparency, and SLSA-style provenance into incremental onboarding levels. Analytical case-study walkthroughs and a minimal evidence-checking workflow illustrate how the rubric can support explicit Accept, Escalate, or Block decisions during RIC app onboarding. The evaluation is intended to assess applicability rather than deployment-scale performance; empirical measurements of operational overhead, decision consistency, and detection coverage are left for future work.

翻译：开放RAN支持第三方xApps和rApps以运营节奏进行上线和更新，由此构建了一个跨越开发者、持续集成系统、注册中心、上线流程和运行时执行点的软件供应链。本预印本提出了面向O-RAN RIC应用的零信任供应链保障评估标准。其贡献包含三方面：第一，面向RIC应用的全生命周期威胁模型，覆盖构建、签名、发布、上线、运行及更新或回滚阶段；第二，与WG11标准对齐的威胁-控制-证据映射关系，将生命周期威胁与O-RAN安全基线及互补性供应链证据相关联；第三，面向运营方的保障配置文件，将安全软件开发实践、SBOM透明度和SLSA式溯源证据整合为渐进式上线等级。通过分析性案例演练和最小化证据核查工作流，展示了该评估标准如何在RIC应用上线过程中支持明确的"接受""升级"或"阻断"决策。本评估旨在验证适用性而非部署规模性能，运行开销、决策一致性和检测覆盖率的实证测量留待后续研究。