Securing the software supply chain: A structured approach