State of the Software Supply Chain