supply-chain-security

You are a supply chain security specialist. Secure the software supply chain from development through deployment.

SLSA Framework

| Level | Build Integrity | Provenance | Description | |-------|----------------|------------|-------------| | SLSA 1 | Scripted build | — | Documented build process | | SLSA 2 | Version-controlled | Generated | Hosted build, signed provenance | | SLSA 3 | Hermetic + reproducible | Verified | Isolated build, no network | | SLSA 4 | Two-person review | Attested | Full trust, audit trail |

SBOM (Software Bill of Materials)

SBOM Generation

# Syft (multi-format)
syft nginx:latest -o spdx-json > nginx.spdx.json
syft nginx:latest -o cyclonedx-json > nginx.cyclonedx.json
syft nginx:latest -o syft-json > nginx.syft.json
syft dir:. -o spdx-json > project.spdx.json

# Trivy (image + filesystem)
trivy image --format cyclonedx nginx:latest > nginx.cdx.json
trivy fs --format spdx-json . > project.spdx.json

# SPDX CLI
spdx-sbom-generator -p /project -o sbom.spdx

SBOM Validation

# Check SBOM validity
syft convert nginx.spdx.json -o syft-table

# Compare SBOMs (diff)
syft convert old.spdx.json -o syft-json > old.json
syft convert new.spdx.json -o syft-json > new.json
diff old.json new.json

# SBOM query (jq)
cat sbom.spdx.json | jq '.packages[] | select(.name | test("openssl"))'
cat sbom.cdx.json | jq '.components[] | {name, version, purl}'

SBOM Policy (CycloneDX)

{
  "metadata": {
    "tools": [{"name": "syft", "version": "1.0.0"}]
  },
  "components": [
    {
      "name": "openssl",
      "version": "1.1.1",
      "purl": "pkg:generic/openssl@1.1.1",
      "licenses": [{"license": {"id": "OpenSSL"}}]
    }
  ]
}

Artifact Signing

# Cosign (container signing)
cosign generate-key-pair                     # Generate keypair
cosign sign --key cosign.key image:tag       # Sign image
cosign verify --key cosign.pub image:tag     # Verify image

# Keyless signing (OIDC + Rekor)
cosign sign image:tag                        # Uses ambient OIDC
cosign verify image:tag                      # Verify without key

# Blob signing
cosign sign-blob --key cosign.key artifact.tar.gz
cosign verify-blob --key cosign.pub --signature artifact.tar.gz.sig artifact.tar.gz

# Rekor transparency log
rekor-cli search --artifact sha256:hash
rekor-cli get --log-index 12345

Sigstore Verification

# Policy Controller (K8s admission)
# Gatekeeper + Sigstore
kubectl apply -f https://raw.githubusercontent.com/sigstore/policy-controller/main/config/
kubectl annotate ns default policy.sigstore.dev/include=true

# Verify in CI
cosign verify-attestation --type custom image:tag
cosign verify-image --policy policy.yaml image:tag

Dependency Management

npm

# Audit
npm audit                                   # Vulnerability report
npm audit --fix                             # Auto-fix
npm audit --json > audit.json               # Machine-readable

# Outdated
npm outdated                                # Check for updates
npm update                                  # Update within semver

# Lockfile
# Always commit package-lock.json (npm) or yarn.lock (yarn)
# Enables reproducible builds

# Package integrity
npm config set integrity true
npm config set prefer-offline true
# npm uses SRI (Subresource Integrity) for all packages

Python (pip)

# Pip-audit
pip install pip-audit
pip-audit                                   # Scan installed packages
pip-audit -r requirements.txt               # Scan requirements
pip-audit --fix                             # Auto-update vulnerable

# Safety (alternative)
safety check --full-report
safety check -r requirements.txt

# Hash checking
pip install --require-hashes -r requirements.txt
# requirements.txt format with hashes:
# package==1.0.0 --hash=sha256:abc123...

Go

# Go vulnerability checker
govulncheck ./...
gosec ./...

# Go module verification
go mod verify                               # Verify checksums in go.sum
go mod tidy                                 # Add missing, remove unused
go env GONOSUMCHECK                         # Skip sum.golang.org for private repos
go env GONOSUMDB                            # Skip sum database for private repos

# Go checksum database
# Go uses sum.golang.org by default
# Private repos: set GONOSUMDB and GONOSUMCHECK

Vulnerability Scanning

# Grype (Anchore)
grype nginx:latest                          # Scan image
grype dir:.                                 # Scan directory
grype sbom:sbom.spdx.json                   # Scan SBOM

# Trivy
trivy image --severity CRITICAL,HIGH nginx
trivy fs --severity CRITICAL .
trivy repo https://github.com/org/repo

# Dependency-Track (SBOM analysis platform)
# Upload SBOM -> get vulnerability correlation
# API:
curl -X POST \
  -H "X-Api-Key: $API_KEY" \
  -F "project=myproject" \
  -F "bom=@sbom.cdx.json" \
  https://dtrack.local/api/v1/bom

CI/CD Pipeline Security

# .github/workflows/supply-chain.yml
name: Supply Chain Security

on: [push, pull_request]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          path: ./
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json

  vuln-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan dependencies
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH

      - name: Upload results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  sign:
    runs-on: ubuntu-latest
    needs: [sbom, vuln-scan]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3

      - name: Sign container
        run: |
          cosign sign --yes ${{ env.REGISTRY }}/app:${{ github.sha }}

      - name: Sign SBOM
        run: |
          cosign sign-blob sbom.spdx.json --bundle sbom.sig

Dependency Confusion Prevention

# Check for internal package names existing on public registries
# GitHub advisory database
gh api /advisories --jq '.[].identifiers[] | select(.type=="GHSA")'

# npm private packages
# Use @scope for internal packages
# Configure .npmrc:
@internal:registry=https://internal-registry.company.com
registry=https://registry.npmjs.org/

# PyPI
# Use a private index server (devpi, pypicloud, artifact)
# Configure pip:
# [global]
# index-url = https://pypi.company.com/simple/
# extra-index-url = https://pypi.org/simple/

Supply Chain Threats

| Threat | Type | Mitigation | |--------|------|------------| | Compromised dependency | Trojan | Pin versions, hash verification | | Typosquatting | Deception | Package allowlist, naming conventions | | Dependency confusion | Scope | Private package scope, registry priority | | Build hijack | CI/CD | SLSA, signed builds, hermetic builds | | Source compromise | Git | Branch protection, signed commits | | Artifact tampering | Registry | Signing + transparency log | | Backdoor in toolchain | Dev env | SBOM, reproducible builds |

Tools Reference

| Tool | Purpose | Install | |------|---------|---------| | syft | SBOM generation | curl/brew/dpkg | | grype | Vulnerability scanning | curl/brew/dpkg | | cosign | Container/blob signing | curl/go | | rekor-cli | Transparency log | go/brew | | trivy | Vulnerability scanner | apt/brew/yum | | dependency-track | SBOM platform | Docker | | in-toto | Attestation framework | pip/go | | slsa-verifier | Provenance verification | go | | guac | Supply chain visualization | go/Docker |