Software Supply Chain Security: Lockfiles, Release Cooldowns, OIDC Trusted Publishing and Sigstore Signatures

A practical guide to closing the five doors a supply chain attack walks through: strict lockfile installs, blocking the postinstall scripts that propagated the Shai-Hulud worm, release cooldowns (min-release-age, minimumReleaseAge, npmMinimalAgeGate) coordinated with Dependabot and Renovate, pinning GitHub Actions to full SHAs with pinact, least-privilege permissions and the pull_request_target trap, token-free publishing with OIDC Trusted Publishing on PyPI and npm, SLSA build provenance and SBOM attestations signed with Sigstore, and admission-time verification with cosign and Kyverno that checks identity, not just signature. Includes a CI-ready lockfile audit script, complete workflows, the eight mistakes that undo all the work, an impact-ordered rollout plan, a production checklist and an FAQ. Expanded edition: the same model applied to Python (wheels vs sdists, --require-hashes), Go (sum.golang.org and the GOPRIVATE=* trap), Rust (build.rs, cargo-vet, cargo-deny), Gradle (verification-metadata.xml) and digest-pinned base images; dependency confusion, typosquatting and slopsquatting with a CI-ready pull request check; Sigstore from the inside (Fulcio, Rekor, and why you verify identity rather than a key); operational SBOMs with CycloneDX, Dependency-Track and VEX; a first-24-hours incident runbook; and governing this at scale with OpenSSF Scorecard, SLSA levels and reusable workflows.