For too long we have implicitly trusted software that we purchase, or download, both commercial and open source. With the move to Zero Trust for system architecture we need to think about the forgotten architecture pillar, software. Do we need to implicitly trust software creators or is there a better way? This talk will discuss the new supply chain transparency requirements from the Biden Cybersecurity Executive Order and how vendors can be transparent with the security posture of their software.