If you want a software supply chain that includes formal agreements, use Java or C#, or maybe C++. Those ecosystems have plenty of vendors who will sell you libraries, including phone support and liability.
So far enterprises are the only ones willing to pay for their "software supply chain", if you want this kind of "solution" just use what they use.
The sensitive nature of our business forced the equation for us. We are basically a pure Microsoft shop because it makes survival of audits feasible. 100% of our B2B clients are already doing business with them, so the conversation is fairly simple.
So far enterprises are the only ones willing to pay for their "software supply chain", if you want this kind of "solution" just use what they use.