Software Supply Chain Security: A Taxonomy of Attacks and a Comparative Analysis of Provenance-Based Countermeasures

This article analyses the security of the software supply chain, which has become one of the fastest-growing attack surfaces in modern information systems. A five-stage reference model of the supply chain with explicit trust boundaries is proposed, and a taxonomy of attacks is derived from it in which every class is bound to a concrete injection point: source tampering, dependency abuse, build injection, artifact substitution and delivery tampering. The verification problem is stated formally as a predicate over signed build provenance, and the resulting conditions are then used as evaluation criteria. On this basis the principal countermeasures — the software bill of materials (SPDX and CycloneDX), signed build provenance (in-toto and the SLSA Build levels), artifact signing and reproducible builds — are compared with respect to the attack classes they actually mitigate rather than the guarantees they are commonly assumed to provide. The analysis is validated against the XZ Utils backdoor (CVE-2024-3094). It is shown that a bill of materials and a valid artifact signature would not have prevented that attack, whereas a hermetic build at SLSA Build Level 3 combined with reproducible builds breaks its central mechanism — the divergence between the released source archive and the publicly auditable repository. The residual gap between declared and auditable build inputs is formalised and proposed as a practical assurance metric. The compliance of the examined mechanisms with the legislation of the Republic of Uzbekistan and with international regulation is substantiated. The results indicate that supply chain assurance should be designed as a verification chain over the build process rather than as an inventory of components.