> It's a difficult coordination problem.

Well, it depends on the language: language which "capabilities" (both for the source code and for the building* ) could in theory really reduce a lot of the burden to identify supply chain attacks.

*: some research language have/had capabilities which would make supply chain attack "obvious" but for build systems I don't know if this exist.