A practical guide to software supply chain security