Safeguarding artifact integrity across any software supply chain