Supply chain security sbom slsa

Supply Chain Security: SBOM, SLSA, & Artifact Attestation

Overview

This skill provides production-ready patterns, automation templates, and Zero-Trust validation gates for securing software supply chains. It establishes end-to-end provenance verification, artifact integrity signing using Sigstore/Cosign, and automated SBOM analysis against vulnerability intelligence feeds.

---

1. Core Architectural Principles & Zero-Trust Governance

1. Explicit Provenance Verification: Never trust unverified build outputs. Every container image, binary, and package must present verifiable SLSA Level 3+ provenance signed by ephemeral OIDC tokens.
2. Deterministic & Reproducible Builds: Strive for hermetic build execution environments where identical source inputs yield bit-for-bit identical outputs.
3. Continuous Cryptographic Verification: Validate signatures, SBOM attestations, and vulnerability thresholds at admission control (Kubernetes Policy Engine / Kyverno / Gatekeeper) and before deployment.
4. Least Privilege Build Identities: Build pipelines must operate with short-lived, identity-bound tokens (e.g., GitHub OIDC federated to cloud IAM) rather than static, long-lived credentials.

---

2. Pipeline Gates & Policy Enforcement

Gate Phase	Tooling	Enforcement Rules
Source / Pre-Build	Git Commit Signing, Dependency-Check	Block unverified commits; block dependencies with known critical CVEs without approved exception annotations.
Build Time	SLSA Generator, Syft, Cosign	Generate SPDX/CycloneDX SBOM; produce in-toto provenance attestation; sign artifacts via Keyless Sigstore.
Post-Build Validation	Grype, Trivy, Cosign Verify	Block image pushing/deployment if unverified signatures exist or high/critical vulnerabilities violate SLA.
Deploy / Admission	Kyverno / Policy Controller	Enforce image signature verification, SLSA provenance check, and minimum required SBOM attestation.

---

3. Anti-Patterns & Risk Vectors

• Anti-Pattern: Static API Keys in Build Systems
  • Risk: Long-lived cloud keys leaked in runner logs or cached workspaces.
  • Remediation: Use Workload Identity Federation / OIDC with dynamic keyless Sigstore signing.
• Anti-Pattern: Unattached / Post-Hoc SBOM Generation
  • Risk: Generating SBOMs after deployment or outside the build pipeline creates drift between artifact reality and cataloged components.
  • Remediation: Embed SBOM generation into the build pipeline and cryptographically attach attestations using cosign attest.
• Anti-Pattern: Floating Tags & Dynamic Dependencies
  • Risk: Pulling :latest base images or unbounded dependency versions (* or ^) enables upstream dependency confusion and typosquatting attacks.
  • Remediation: Pin dependencies and base images strictly by immutable cryptographic SHA-256 digests.

---

4. Production Code Examples

A. GitHub Actions Workflow: SBOM, SLSA Provenance, & Keyless Cosign Signing (.github/workflows/supply-chain.yml)

name: Supply Chain Security Pipeline

on:
  push:
    branches: [ "main" ]
    tags: [ "v*.*.*" ]

permissions:
  contents: read
  id-token: write # Required for GitHub OIDC federated authentication & Sigstore keyless signing
  packages: write

jobs:
  build-and-secure:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Cosign & Syft
        uses: sigstore/[email protected]

      - name: Install Syft
        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Metadata & Digest
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: type=semver,pattern={{version}},default=latest

      - name: Build and Push OCI Image
        id: build-image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          provenance: false # Explicitly generating SLSA provenance below

      - name: Generate CycloneDX SBOM
        run: |
          syft ghcr.io/${{ github.repository }}@${{ steps.build-image.outputs.digest }} \
            -o cyclonedx-json=sbom.cdx.json

      - name: Attach SBOM Attestation with Cosign
        run: |
          cosign attest --yes \
            --type cyclonedx \
            --predicate sbom.cdx.json \
            ghcr.io/${{ github.repository }}@${{ steps.build-image.outputs.digest }}

      - name: Sign Container Image Keylessly (Sigstore OIDC)
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.build-image.outputs.digest }}

  # SLSA Level 3 Provenance Generator
  provenance:
    needs: [build-and-secure]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
    with:
      image: ghcr.io/${{ github.repository }}
      digest: ${{ needs.build-and-secure.outputs.digest }}
    secrets:
      registry-username: ${{ github.actor }}
      registry-password: ${{ secrets.GITHUB_TOKEN }}

---

B. Python Script: Automated Vulnerability & Policy Validation Gate (verify_sbom.py)

#!/usr/bin/env python3
"""
Automated SBOM Vulnerability Policy Validator
Analyzes CycloneDX SBOM files against CVE severity thresholds and policy requirements.
"""

import json
import sys
import subprocess
from typing import Dict, Any, List

SEVERITY_FAIL_THRESHOLD = ["CRITICAL", "HIGH"]
FORBIDDEN_LICENSES = ["GPL-3.0", "AGPL-3.0"]

def run_grype_sbom_scan(sbom_path: str) -> Dict[str, Any]:
    """Execute Anchore Grype on local CycloneDX SBOM."""
    cmd = ["grype", f"sbom:{sbom_path}", "-o", "json"]
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    return json.loads(result.stdout)

def parse_cdx_licenses(sbom_path: str) -> List[str]:
    """Extract component licenses from CycloneDX SBOM."""
    with open(sbom_path, 'r', encoding='utf-8') as f:
        data = json.load(f)
    
    licenses = []
    for component in data.get("components", []):
        for lic in component.get("licenses", []):
            if "license" in lic and "id" in lic["license"]:
                licenses.append(lic["license"]["id"])
    return licenses

def evaluate_security_policy(vulnerabilities: Dict[str, Any], licenses: List[str]) -> bool:
    """Enforce Zero-Trust vulnerability and compliance policy gates."""
    violations = []

    # Check Vulnerabilities
    for match in vulnerabilities.get("matches", []):
        vuln = match.get("vulnerability", {})
        severity = vuln.get("severity", "").upper()
        cve_id = vuln.get("id")
        pkg_name = match.get("artifact", {}).get("name")

        if severity in SEVERITY_FAIL_THRESHOLD:
            violations.append(f"[CVE] {severity} - {cve_id} in package '{pkg_name}'")

    # Check Licenses
    for lic in licenses:
        if lic in FORBIDDEN_LICENSES:
            violations.append(f"[LICENSE] Non-compliant license detected: {lic}")

    if violations:
        print("\n❌ SECURITY POLICY GATE FAILED:")
        for v in violations:
            print(f"  - {v}")
        return False

    print("\n✅ SECURITY POLICY GATE PASSED: Zero critical/high CVEs or policy violations detected.")
    return True

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python verify_sbom.py <path_to_sbom.cdx.json>")
        sys.exit(1)

    sbom_file = sys.argv[1]
    print(f"[*] Scanning SBOM file: {sbom_file}")
    
    try:
        scan_results = run_grype_sbom_scan(sbom_file)
        sbom_licenses = parse_cdx_licenses(sbom_file)
        success = evaluate_security_policy(scan_results, sbom_licenses)
        if not success:
            sys.exit(1)
    except Exception as err:
        print(f"[-] Policy Enforcement Error: {err}")
        sys.exit(1)

---

C. Kyverno Policy: Enforce Cosign Signature & SLSA Attestation in Kubernetes (kyverno-policy.yaml)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-signature-and-slsa
  annotations:
    policies.kyverno.io/title: Verify Image Cosign Signatures & SLSA Provenance
    policies.kyverno.io/subject: Pod, Container
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-image-signature
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/your-org/*"
          keyless:
            issuer: "https://token.actions.githubusercontent.com"
            subject: "https://github.com/your-org/*"
          attestations:
            - predicateType: https://slsa.dev/provenance/v0.2
              attestors:
                - entries:
                    - keyless:
                        issuer: "https://token.actions.githubusercontent.com"
                        subject: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v2.0.0"