Too many software supply chain defense bibles? Boffins distill advice