Supply-chain integrity is the set of controls that help ensure software, updates, libraries, and build dependencies are genuine and have not been altered in transit or during production. In practice, it relies on things like code signing, checksum verification, trusted package sources, and provenance records that show where an artifact came from and how it was built.
This matters because attackers often target the software supply chain instead of a single endpoint. If a developer dependency, update server, or build pipeline is compromised, malicious code can be distributed to many systems at once while appearing legitimate. Defenses include signed releases, dependency pinning, software bills of materials, secure build pipelines, and verification before installation. Strong supply-chain integrity makes it harder for tampered code to enter an environment and easier to detect when something has changed unexpectedly.