Laying out the elements of a secure software supply chain