Supply Chain Security: Protecting the Software Chain
Supply chain security in software refers to protecting the entire process of creating, distributing, and consuming software. Supply chain attacks are growing exponentially: compromising a single component in the chain allows attacking thousands of downstream organizations.
The SolarWinds attack of 2020 and the XZ Utils incident of 2024 demonstrated how vulnerable the supply chain is. In this article, we will explore the standards and tools for protecting the software chain: SBOM for component inventory, Sigstore for artifact signing, and the SLSA framework for provenance verification.
What You'll Learn
- What an SBOM is and why it's fundamental
- SBOM standards: CycloneDX and SPDX
- Sigstore: artifact signing and verification
- SLSA framework for supply chain integrity
- Automatic SBOM generation in the CI/CD pipeline
- Artifact provenance verification
SBOM: Software Bill of Materials
An SBOM (Software Bill of Materials) is a complete inventory of all components that make up a software product: libraries, frameworks, tools, and their exact versions. Like an ingredient list for food, the SBOM lets you know exactly what's inside the software.
SBOM has become a legal requirement in many contexts: US Executive Order 14028 requires it for federal government suppliers, and European regulations (NIS2, Cyber Resilience Act) are making it mandatory for digital products sold in the EU.
SBOM Standards: CycloneDX vs SPDX
SBOM Standards Comparison
| Feature | CycloneDX | SPDX |
|---|---|---|
| Maintained by | OWASP | Linux Foundation |
| Focus | Security and risk management | License compliance |
| Formats | JSON, XML, Protobuf | JSON, RDF, Tag-Value |
| VEX support | Native | Through extensions |
| Adoption | Security community, DevSecOps | Enterprise, government |
Generate SBOM with Syft
# Install Syft
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh
# Generate SBOM from a Docker image (CycloneDX)
syft myapp:latest -o cyclonedx-json > sbom-cyclonedx.json
# Generate SBOM in SPDX format
syft myapp:latest -o spdx-json > sbom-spdx.json
# Generate SBOM from local filesystem
syft dir:. -o cyclonedx-json > sbom-project.json
# Generate SBOM from a lock file
syft file:package-lock.json -o cyclonedx-json > sbom-deps.json
SBOM in the CI/CD Pipeline
# .github/workflows/sbom.yml
name: SBOM Generation
on:
push:
branches: [main]
tags: ["v*"]
jobs:
sbom:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build Docker image
run: docker build -t myapp: