Securing the AI Software Supply Chain