TY - RPRT TI - Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain AU - Derek Garcia PY - 2026 UR - https://arxiv.org/abs/2610.28794 ID - 2610.28794 ER -