This article is a guide on establishing a secure software supply chain using ModelKits. It is aimed at technical practitioners in AI/ML deployment pipelines who require effective methods for ensuring the authenticity and integrity of software artifacts. The document outlines the roles of attestations, provenance, and immutability in building a trusted pipeline and discusses best practices, compliance considerations, and emerging trends.