Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.
Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.
Authorized Use Only: Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.
Overview
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:
CycloneDX — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).
SPDX — a Linux Foundation / ISO standard (ISO/IEC 5962) strong on licensing and provenance.
The reference open-source toolchain is from Anchore:
Syft generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.
Grype matches an SBOM (or image) against vulnerability databases to find CVEs.
Cosign (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.
This skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI/CD.
When to Use
Establishing and maintaining a component inventory for applications and container images.
Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).
Satisfying procurement/regulatory SBOM requirements (CISA, EO 14028).
Producing signed SBOM attestations for downstream supply-chain trust.
Prerequisites
Install Syft and Grype (official install scripts):
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
Install Cosign for signing/attestation:
# via Go, or download a release from https://github.com/sigstore/cosign/releases
go install github.com/sigstore/cosign/v2/cmd/cosign@latest
Access to the target images/source and (for signing) a registry plus keys or keyless OIDC.
Objectives
Generate CycloneDX and SPDX SBOMs from images and directories.
Scan SBOMs and images for vulnerabilities with Grype.
Gate CI/CD builds on severity thresholds.
Sign and attach SBOM attestations with Cosign and verify them.
MITRE ATT&CK Mapping
ID
Official Technique Name
Relevance to this skill
T1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique.
This is a defensive supply-chain skill; the mapping reflects the adversary technique it is designed to detect and mitigate.
Workflow
1. Generate a CycloneDX SBOM from a container image
-o <format> selects output; cyclonedx-json is security-oriented.
Feed Grype JSON into your vulnerability management workflow: deduplicate by CVE, enrich with EPSS/KEV for prioritization, and track remediation SLAs. Re-scan stored SBOMs on each Grype DB update to catch newly disclosed CVEs in unchanged artifacts.
