https://www.opensourcerers.org/2022/11/21/securing-the-integrity-of-software-supply-chains/