Supply chain trust is the confidence that software artifacts, packages, dependencies, and build metadata remain authentic and unchanged between creation and deployment. It depends on knowing who produced the code, how it was built, and whether anything altered it in transit or inside a repository manager.
It matters because attackers often target the supply chain instead of the final host. If they can tamper with a package, inject a malicious dependency, or modify build metadata, they can spread compromise to many downstream systems. Defenders protect this trust with signed artifacts, checksums, provenance records, access control, least privilege, MFA, and isolated build pipelines. In practice, strong supply chain trust helps organizations detect poisoned packages, unauthorized repository changes, and unsafe releases before they reach production.