# Supply Chain Security A facility's integrity depends on components it did not make and software it did not write. Supply chain security is the discipline of establishing that each of those is genuinely what it claims to be: manufactured by whom it says, carrying the firmware it should, built from the source it claims, and unmodified since. > [!note] The one-sentence version > Prove that every part and every program is what it says it is, and that nobody changed it on the way here. ## The hardware chain **Provenance and authorized channels.** Buying through authorized distribution rather than secondary markets, which is the practical defense against counterfeit and recycled components; counterfeit electronics are a real and documented problem, particularly in long-lived equipment. **Tamper evidence in transit.** Sealed packaging, serial verification against the manufacturer's record, and inspection on receipt. **Device identity.** Cryptographic identity established at manufacture and verifiable afterward, so a component can prove which factory produced it. **Firmware signing and verified boot.** Each stage verifies the signature of the next before executing it, anchored in a hardware root of trust, so that unsigned or modified firmware does not run. The management controller requires this treatment as rigorously as the main system, since it has complete physical control; see [[wiki/Baseboard Management Controller|Baseboard Management Controller]]. **Attestation.** Hardware reporting, in a signed form, what firmware and configuration it is actually running, which turns a policy into a verifiable fact; see [[wiki/Confidential Computing|Confidential Computing]]. ## The software chain **Signed artifacts and pinned digests.** Container images and packages referenced by immutable content hash rather than by a movable label; see [[wiki/OCI Container|OCI Container]]. **Software bill of materials.** A machine-readable inventory of every component and version inside an artifact, which is what makes the question "are we affected by this vulnerability" answerable in minutes rather than weeks. **Build provenance.** Attestation describing which source, which builder, and which parameters produced an artifact, so that a binary can be traced to a commit. **Dependency and base-image hygiene.** Controlling what is pulled in transitively, which is where most practical exposure lives. ## Why it is strategically significant The equipment in these facilities is manufactured across a long international chain, with the deepest concentration at the most advanced steps; see [[wiki/Supply Chain Chokepoint|Supply Chain Chokepoint]]. Verification is therefore how a nation gains assurance over hardware it cannot entirely manufacture, and it is a capability the United States can build independently of where the silicon was fabricated. Domestic manufacture of components and verified provenance for the rest are complementary rather than competing strategies, and defense and critical-infrastructure requirements for trusted microelectronics have driven much of the relevant engineering; see [[wiki/Semiconductor Export Controls|Semiconductor Export Controls]]. ## Relationships - **verifies:** [[wiki/Baseboard Management Controller|Baseboard Management Controller]] · [[wiki/OCI Container|OCI Container]] · [[wiki/Compute Tray|Compute Tray]] - **complements:** [[wiki/Confidential Computing|Confidential Computing]] · [[wiki/Data Center Security|Data Center Security]] - **contextualized by:** [[wiki/Supply Chain Chokepoint|Supply Chain Chokepoint]] · [[wiki/Semiconductor Export Controls|Semiconductor Export Controls]] - **civic dimension:** [[wiki/National Compute Capacity|National Compute Capacity]] · [[wiki/Industrial Competence|Industrial Competence]] - **source articles:** [[articles/Vertically Integrating an AI Superpower from AI Factory to Citizen|Vertically Integrating an AI Superpower from AI Factory to Citizen]] · [[articles/The Gigawatt Is the New Measure of War|The Gigawatt Is the New Measure of War]] - **collection route:** [[collections/American Infrastructure|American Infrastructure]] · [[collections/American|American Collection]] ## Evidence posture - **Established:** counterfeit and recycled electronics as a documented problem addressed through authorized distribution and receipt verification; cryptographic device identity established at manufacture; firmware signing with verified boot anchored in a hardware root of trust; hardware attestation of firmware and configuration; signed and digest-pinned software artifacts; software bills of materials; build provenance attestation; transitive dependency control. - **Established:** defense and critical-infrastructure requirements for trusted and radiation-hardened advanced microelectronics driving domestic capability programs. - **Strongly indicated:** verification providing meaningful assurance over components manufactured abroad; the mechanism is sound and comprehensive coverage across fleets is still developing. ## Sources - [How AI Is Pushing the Semiconductor Supply Chain to the Limit](https://www.bloomberg.com/) — Bloomberg Originals, October 2026; defense requirements for trusted advanced chips and domestic manufacturing programs. - Platform firmware security and software supply chain attestation standards, as current October 2026.