[fathermarz]

The issue with software supply chain is that you have to be in step the entire chain and developers are creative. I don’t have to pull in a dependency when I can copy paste code out of third party repos or stack overflow.

Also this doesn’t take into consideration one of the ugliest sides of SSC which is M&A. Sure on a completely greenfield piece of software, seems like it would be a solution (although over engineered tbh). But that doesn’t really exist in closed source systems as they are Frankenstein pieces of software that get new stuff bolted onto them.