  The software bill of materials (SBOM) concept aims to include more
information about a software build such as copyrights, dependencies and
security references. But SBOM lacks visibility into the process for building a
package. Efforts such as Supply-chain Levels for Software Artifacts (SLSA) try
to remedy this by focusing on the quality of the build process. But they lack
quantitative assessment of that quality. They are purely qualitative. A new
form of assurance case and new technique for structuring it, called process
reduction, are presented. An assurance case for a toolchain is quantitative and
when structured as a process reduction can measure the strength of the
toolchain via the strength of the reduction. An example is given for a simple
toolchain.
