> We are owed supply chain security.

Careful, requiring that might get you completely unmaintained software instead.