# Design a software supply chain security platform: system design interview question

> Deployment security checks: artifact identity, trusted evidence, dependency rules, policy changes, and safe behavior during failures.

Source: https://sysround.com/questions/design-software-supply-chain-security-platform
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a platform that checks software artifacts before deployment and applies security policies across an organization. Teams need fast, reliable deployment checks."

## What to clarify first

- Artifact and deployment scope
- Scale and traffic mix
- Latency
- Required checks
- Trust and certificate time
- Consistency and freshness
- Artifact identity
- Storage and durability
- Dependency information
- Availability and failure behavior

## Scope of a strong answer

Core requirements:

- Verify artifact signatures, build provenance, and dependency metadata
- Apply organization policies to each deployment
- Prevent deployment of an artifact that fails verification
- Record each decision and its supporting evidence

Usually out of scope:

- Build artifacts or operate a container registry
- Discover vulnerabilities
- Prove that dependency metadata includes every dependency
- Protect compromised nodes or compromised cluster administrators

## What interviewers probe

### What makes evidence acceptable

A valid signature does not establish organizational trust. Evidence can describe the wrong artifact or omit important facts.

### Artifact identity

Tags can change between verification and download. Workload changes can introduce images after an earlier approval.

### Policy changes and old decisions

An unchanged artifact can become unacceptable after a policy change or key compromise. Old approvals must stop working within a fixed limit.

### Deployment check latency

Tag requests require registry access even when evidence is ready. Slow registries and large evidence can consume the admission deadline.

## Common mistakes

- The platform treats a valid signature as approval from the organization.
- The platform verifies an image tag but lets the cluster download different bytes.
- The platform caches approvals without policy, trust, advisory, or deployment context.
- The latency claim excludes tag resolution without stating that boundary.
- The platform permits unchecked deployments when verification fails.
- The candidate claims that signed dependency metadata proves completeness.

## The bar by level

- **Senior:** Separates evidence verification from policy evaluation. Covers all image paths, versioned decisions, certificate expiry, revocations, and durable audit records. Accounts for registry access in tag latency. Defines failure behavior that preserves the 60-second freshness bound.
- **Staff+:** Defines trust boundaries across organizations, registries, and clusters. Prevents stale approvals during concurrent policy changes and widespread lease expiry. Reconciles audit durability, external dependencies, and availability during correlated failures. Explains which guarantees signatures and dependency metadata cannot provide.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=software-supply-chain-security


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.