Supply chain security for devs

true; }

private checkSBOM(): SBOMCheckResult { const expectedPath = path.join(this.sbomDir, 'cyclonedx.json'); if (!fs.existsSync(expectedPath)) { return { valid: false, message: 'CycloneDX SBOM not found in expected directory.' }; }

try {
  const content = JSON.parse(fs.readFileSync(expectedPath, 'utf-8'));
  const hasMetadata = content.metadata && content.metadata.tools && content.components;
  if (!hasMetadata) {
    return { valid: false, message: 'SBOM missing required metadata or components.' };
  }
  return { valid: true, message: 'Valid CycloneDX SBOM detected.', sbomPath: expectedPath };
} catch {
  return { valid: false, message: 'Failed to parse SBOM JSON.' };
}

}

private async checkSignature(): Promise<SignatureCheckResult> { try { // Cosign keyless verification against Fulcio/Rekor transparency log const cmd = cosign verify --certificate-identity-regexp=".*" --certificate-oidc-issuer-regexp=".*" ${this.artifactRef}; execSync(cmd, { stdio: 'inherit' }); return { valid: true, message: 'Artifact signature verified against transparency log.' }; } catch (error: any) { return { valid: false, message: Cosign verification failed: ${error.message || 'Unknown error'} }; } } }

// Usage in CI pipeline async function main() { const artifact = process.env.ARTIFACT_REF || 'ghcr.io/org/app:v1.2.0'; const validator = new SupplyChainValidator(artifact); const passed = await validator.validate(); process.exit(passed ? 0 : 1); }

main().catch(err => { console.error('Validation runner failed:', err); process.exit(2); });

### Architecture Decisions and Rationale

- **Keyless Signing over Static Keys:** Static signing keys create rotation overhead and secret management risk. Keyless signing (via Sigstore/Cosign) uses OIDC identity from your CI provider, issues short-lived certificates from Fulcio, and logs signatures to Rekor. This eliminates key rotation while maintaining non-repudiation.
- **CycloneDX over SPDX:** CycloneDX provides richer dependency relationship mapping and built-in support for vulnerability exploitation data (VEX). It integrates natively with Syft, Grype, and modern policy engines.
- **SLSA Level 3 as Baseline:** Level 3 requires hosted build platforms, build script versioning, and provenance generation. It blocks most CI runner hijacking and ensures reproducible builds. Level 4 (hardware-backed) is reserved for high-assurance environments.
- **Policy Enforcement at Admission, Not Just CI:** CI gates catch issues early, but deployment-time verification prevents bypasses. Kubernetes OPA/Gatekeeper or Kyverno policies should reject pods referencing unsigned images or missing SBOM annotations.

## Pitfall Guide

1. **Scanning Only Direct Dependencies**
   Package managers resolve transitive dependencies automatically. Ignoring them leaves 60-80% of your attack surface unmonitored. Always generate full dependency graphs and scan them. Use lockfiles to pin versions and prevent unexpected transitive updates.

2. **Treating SBOMs as Compliance Artifacts**
   An SBOM is useless if it sits in a vault. Integrate it into vulnerability scanning, dependency update automation, and runtime attestation. Without active consumption, it generates zero security value.

3. **Ignoring Build Environment Integrity**
   A compromised CI runner can inject malicious code before signing occurs. Use ephemeral runners, verify builder images, and enforce SLSA provenance. Never sign artifacts built on shared or unverified infrastructure.

4. **Signing Without Verification Policies**
   Cryptographic signatures are meaningless if deployment pipelines don't validate them. Configure admission controllers to reject unsigned or expired certificates. Signing without verification creates false confidence.

5. **Over-Scanning Without Triage Workflows**
   Scanners generate noise. Without severity filtering, exploitability scoring, and automated ticketing, engineers will disable checks. Implement CVSS + EPSS scoring, suppress known false positives, and route critical findings to incident response.

6. **Assuming Base Images Are Inherently Safe**
   Official container images are not immune to supply chain attacks. They can contain outdated packages, misconfigured permissions, or compromised build layers. Scan base images independently, pin them by digest, and rebuild regularly.

7. **Neglecting Developer Tooling Security**
   IDE extensions, local package caches, and pre-commit hooks can be compromised. Enforce hash verification for npm/pip/cargo packages, disable automatic extension updates, and scan developer environments periodically.

**Production Best Practices:**
- Pin all dependencies to exact versions or SHA256 digests.
- Use private registries with mirroring and vulnerability filtering.
- Automate SBOM generation and attachment to every release artifact.
- Implement VEX (Vulnerability Exploitability eXchange) to declare which CVEs do not apply to your build.
- Rotate CI runner credentials and enforce least-privilege IAM for build service accounts.

## Production Bundle

### Action Checklist
- [ ] Generate CycloneDX SBOM for every build artifact using Syft or native package manager output
- [ ] Integrate Grype/Trivy scanning into CI with EPSS-based severity filtering
- [ ] Enable SLSA Level 3 provenance generation via GitHub Actions or GitLab CI attestation
- [ ] Configure Cosign keyless signing with Fulcio/Rekor for all container images and binaries
- [ ] Deploy OPA/Gatekeeper or Kyverno policies to reject unsigned or unattested artifacts at admission
- [ ] Implement VEX documents to suppress non-exploitable CVEs and reduce alert noise
- [ ] Pin base images and dependencies by digest, not tag, across all environments
- [ ] Run quarterly supply chain tabletop exercises simulating CI compromise or dependency hijacking

### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| Small team, rapid iteration | Keyless Cosign + Grype CI gate + CycloneDX SBOM | Minimal overhead, immediate coverage, scales with team size | Low (free tiers + CI compute) |
| Enterprise, regulated compliance | SLSA L3 + KMS-backed signing + OPA admission + VEX | Audit-ready provenance, cryptographic non-repudiation, policy enforcement | Medium (HSM/KMS licensing, policy engineering) |
| High-assurance / critical infrastructure | Hardware-backed builders + SLSA L4 + Rekor transparency + runtime attestation | Blocks nation-state supply chain attacks, ensures full traceability | High (dedicated infrastructure, compliance overhead) |
| Legacy monolith with unmaintained deps | Private registry mirroring + dependency pinning + container scanning + runtime eBPF monitoring | Reduces attack surface without refactoring, enables safe deployment | Medium (registry costs, monitoring stack) |

### Configuration Template

GitHub Actions workflow implementing SBOM generation, vulnerability scanning, provenance attestation, and keyless signing.

```yaml
name: Supply Chain Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  IMAGE: ghcr.io/${{ github.repository }}/app:${{ github.sha }}

jobs:
  build-and-attest:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push Image
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ${{ env.IMAGE }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE }}
          format: cyclonedx-json
          output-file: sbom.json
          attach-checksum: true

      - name: Scan for Vulnerabilities
        uses: anchore/scan-action@v3
        with:
          image: ${{ env.IMAGE }}
          fail-build: true
          severity-cutoff: high

      - name: Generate Build Provenance
        uses: slsa-framework/slsa-github-generator/.github/actions/generate-provenance@v1.9.0
        with:
          subject: ${{ env.IMAGE }}
          output-file: provenance.json

      - name: Sign Artifact
        uses: sigstore/cosign-action@v3.3.0
        with:
          images: ${{ env.IMAGE }}
          upload: true
          annotations: |
            build-id=${{ github.run_id }}
            commit=${{ github.sha }}

Quick Start Guide

1. Install tooling: brew install syft grype cosign (macOS/Linux). Verify with syft version and cosign version.
2. Generate your first SBOM: syft scan dir:. -o cyclonedx-json > sbom.json. Inspect the output to confirm dependency graph accuracy.
3. Scan immediately: grype sbom:sbom.json --fail-on high. Integrate this command into your CI pipeline as a blocking step.
4. Enable keyless signing: In GitHub Actions, request id-token: write permission and run cosign sign --yes <image-ref>. Verify with cosign verify <image-ref>.
5. Enforce at deployment: Add a Kyverno policy or OPA rule that rejects pods referencing images without valid Sigstore signatures. Test with kubectl apply --dry-run=server -f pod.yaml.

Supply chain security is not a product. It is a verification discipline. When every artifact carries a cryptographic fingerprint, every build records its origin, and every deployment enforces policy, you stop guessing and start proving. That is the difference between hope and security.