Where does your software (really) come from?

GitHub is working with the OSS community to bring new supply chain security capabilities to the platform.