Log4j showed how easy it is to hack popular software artifacts. Open-source projects and vendors are racing to make it easier for developers to lock down their software supply chains. In the early ...