Securing the Software Supply Chain