supply-chain-security-sbom-slsa

name	supply-chain-security-sbom-slsa
description	Comprehensive framework for software supply chain security incorporating Software Bill of Materials (SBOM) generation/validation, SLSA (Supply-chain Levels for Software Artifacts) provenance compliance, image signing with Cosign/Sigstore, and automated pipeline verification.

Supply Chain Security: SBOM, SLSA, & Artifact Attestation

Overview

This skill provides production-ready patterns, automation templates, and Zero-Trust validation gates for securing software supply chains. It establishes end-to-end provenance verification, artifact integrity signing using Sigstore/Cosign, and automated SBOM analysis against vulnerability intelligence feeds.

---

1. Core Architectural Principles & Zero-Trust Governance

1. Explicit Provenance Verification: Never trust unverified build outputs. Every container image, binary, and package must present verifiable SLSA Level 3+ provenance signed by ephemeral OIDC tokens.
2. Deterministic & Reproducible Builds: Strive for hermetic build execution environments where identical source inputs yield bit-for-bit identical outputs.
3. Continuous Cryptographic Verification: Validate signatures, SBOM attestations, and vulnerability thresholds at admission control (Kubernetes Policy Engine / Kyverno / Gatekeeper) and before deployment.
4. Least Privilege Build Identities: Build pipelines must operate with short-lived, identity-bound tokens (e.g., GitHub OIDC federated to cloud IAM) rather than static, long-lived credentials.

---

2. Pipeline Gates & Policy Enforcement

Gate Phase	Tooling	Enforcement Rules
Source / Pre-Build	Git Commit Signing, Dependency-Check	Block unverified commits; block dependencies with known critical CVEs without approved exception annotations.
Build Time	SLSA Generator, Syft, Cosign	Generate SPDX/CycloneDX SBOM; produce in-toto provenance attestation; sign artifacts via Keyless Sigstore.
Post-Build Validation	Grype, Trivy, Cosign Verify	Block image pushing/deployment if unverified signatures exist or high/critical vulnerabilities violate SLA.
Deploy / Admission	Kyverno / Policy Controller	Enforce image signature verification, SLSA provenance check, and minimum required SBOM attestation.

---

3. Anti-Patterns & Risk Vectors

• Anti-Pattern: Static API Keys in Build Systems
  • Risk: Long-lived cloud keys leaked in runner logs or cached workspaces.
  • Remediation: Use Workload Identity Federation / OIDC with dynamic keyless Sigstore signing.
• Anti-Pattern: Unattached / Post-Hoc SBOM Generation
  • Risk: Generating SBOMs after deployment or outside the build pipeline creates drift between artifact reality and cataloged components.
  • Remediation: Embed SBOM generation into the build pipeline and cryptographically attach attestations using cosign attest.
• Anti-Pattern: Floating Tags & Dynamic Dependencies
  • Risk: Pulling :latest base images or unbounded dependency versions (* or ^) enables upstream dependency confusion and typosquatting attacks.
  • Remediation: Pin dependencies and base images strictly by immutable cryptographic SHA-256 digests.

---

4. Production Code Examples

A. GitHub Actions Workflow: SBOM, SLSA Provenance, & Keyless Cosign Signing (.github/workflows/supply-chain.yml)

name: Supply Chain Security Pipeline

on:
  push:
    branches: [ "main" ]
    tags: [ "v*.*.*" ]

permissions:
  contents: read
  id-token: write # Required for GitHub OIDC federated authentication & Sigstore keyless signing
  packages: write

jobs:
  build-and-secure:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Cosign & Syft
        uses: sigstore/cosign-installer@v3.5.0

      - name: Install Syft
        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh      

             
         
        
           
             
             

           
         
         
        
             
           

            
         
         
        
           
           
             
            

          
         
            
         
             
         
  
  
     []
    
       
       
       
     
    
         
         
    
         
         

---

B. Python Script: Automated Vulnerability & Policy Validation Gate (verify_sbom.py)

#!/usr/bin/env python3
"""
Automated SBOM Vulnerability Policy Validator
Analyzes CycloneDX SBOM files against CVE severity thresholds and policy requirements.
"""

import json
import sys
import subprocess
from typing import Dict, Any, List

SEVERITY_FAIL_THRESHOLD = ["CRITICAL", "HIGH"]
FORBIDDEN_LICENSES = ["GPL-3.0", "AGPL-3.0"]

def run_grype_sbom_scan(sbom_path: str) -> Dict[str, Any]:
    """Execute Anchore Grype on local CycloneDX SBOM."""
    cmd = ["grype", f"sbom:{sbom_path}", "-o", "json"]
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    return json.loads(result.stdout)

def parse_cdx_licenses(sbom_path: str) -> List[str]:
    """Extract component licenses from CycloneDX SBOM."""
    with open(sbom_path, 'r', encoding='utf-8') as f:
        data = json.load(f)
    
    licenses = []
    for component in data.get("components", []):
        for lic in component.get(, []):
               lic    lic[]:
                licenses.append(lic[][])
     licenses

 () -> :
    
    violations = []

    
       vulnerabilities.get(, []):
        vuln = .get(, {})
        severity = vuln.get(, ).upper()
        cve_id = vuln.get()
        pkg_name = .get(, {}).get()

         severity  SEVERITY_FAIL_THRESHOLD:
            violations.append()

    
     lic  licenses:
         lic  FORBIDDEN_LICENSES:
            violations.append()

     violations:
        ()
         v  violations:
            ()
         

    ()
     

 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()

    sbom_file = sys.argv[]
    ()
    
    :
        scan_results = run_grype_sbom_scan(sbom_file)
        sbom_licenses = parse_cdx_licenses(sbom_file)
        success = evaluate_security_policy(scan_results, sbom_licenses)
          success:
            sys.exit()
     Exception  err:
        ()
        sys.exit()

---

C. Kyverno Policy: Enforce Cosign Signature & SLSA Attestation in Kubernetes (kyverno-policy.yaml)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-signature-and-slsa
  annotations:
    policies.kyverno.io/title: Verify Image Cosign Signatures & SLSA Provenance
    policies.kyverno.io/subject: Pod, Container
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-image-signature
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/your-org/*"
          keyless:
            issuer: "https://token.actions.githubusercontent.com"
            subject: "https://github.com/your-org/*"
          attestations:
            - predicateType: https://slsa.dev/provenance/v0.2
              attestors:
                - entries: