Source code and infrastructure integrity
In manufacturing, it's a normal practice to provide a bill of materials (BOM) for a production order. A BOM is a list of raw materials, subassemblies, intermediate assemblies, subcomponents, and parts that have been used to manufacture the end product.
The same thing exists for software: the software bill of materials (SBOM), but it is still less common.
The SBOM
If you have a close look at software supply chain attacks such as the event-stream incident (see Thomas Claburn, 2018), you'll find that they inject malicious code in a release, so the source code in GitHub did not match the files that were included in the npm package. An SBOM can help here with the forensic and it can be used to compare the hashes of different versions.
In the SolarWinds attack (see the Crowdstrike blog, 2021) dependencies were not tempered. Instead, there was an additional process running that manipulated the file system during the execution...
