Supply chain security for devs

es verifiable artifacts at every stage: source, build, distribution, and deployment. The architecture follows SLSA (Supply-chain Levels for Software Artifacts) guidelines, integrating SBOM generation, vulnerability scanning, build provenance, and cryptographic signing.

Step-by-Step Implementation

1. Generate a machine-readable SBOM at build time. Use CycloneDX or SPDX formats. The SBOM must capture direct dependencies, transitive dependencies, and build metadata.
2. Scan the SBOM against vulnerability databases. Integrate tools like Grype or Trivy. Filter results by severity, exploitability, and deployment context.
3. Capture build provenance. Record the builder identity, source commit, environment variables, and execution steps. Store this as a SLSA-compliant attestation.
4. Sign the artifact and its attestation. Use Cosign (Sigstore) to generate keyless or KMS-backed signatures. Attach signatures to container images, binaries, or package archives.
5. Enforce verification at deployment. Configure admission controllers or deployment gates to reject artifacts without valid signatures or compliant SBOMs.

TypeScript Validation Hook

This TypeScript example demonstrates a pre-deployment validator that checks for a CycloneDX SBOM, verifies a Cosign signature, and enforces a minimum SLSA provenance level. It is designed to run in a CI/CD job or as a Kubernetes admission webhook.

import { execSync } from 'child_process';
import * as fs from 'fs';
import * as path from 'path';

interface SBOMCheckResult {
  valid: boolean;
  message: string;
  sbomPath?: string;
}

interface SignatureCheckResult {
  valid: boolean;
  message: string;
  signature?: string;
}

export class SupplyChainValidator {
  private readonly artifactRef: string;
  private readonly sbomDir: string;

  constructor(artifactRef: string, sbomDir: string = './sbom') {
    this.artifactRef = artifactRef;
    this.sbomDir = sbomDir;
  }

  async validate(): Promise<boolean> {
    const sbomCheck = this.checkSBOM();
    if (!sbomCheck.valid) {
      console.error(`[SUPPLY_CHAIN] SBOM validation failed: ${sbomCheck.message}`);
      return false;
    }

    const sigCheck = await this.checkSignature();
    if (!sigCheck.valid) {
      console.error(`[SUPPLY_CHAIN] Signature verification failed: ${sigCheck.message}`);
      return false;
    }

    console.log(`[SUPPLY_CHAIN] Artifact ${this.artifactRef} passed supply chain validation.`);
    return true;
  }

  private checkSBOM(): SBOMCheckResult {
    const expectedPath = path.join(this.sbomDir, 'cyclonedx.json');
    if (!fs.existsSync(expectedPath)) {
      return { valid: false, message: 'CycloneDX SBOM not found in expected directory.' };
    }

    try {
      const content = JSON.parse(fs.readFileSync(expectedPath, 'utf-8'));
      const hasMetadata = content.metadata && content.metadata.tools && content.components;
      if (!hasMetadata) {
        return { valid: false, message: 'SBOM missing required metadata or components.' };
      }
      return { valid: true, message: 'Valid CycloneDX SBOM detected.', sbomPath: expectedPath };
    } catch {
      return { valid: false, message: 'Failed to parse SBOM JSON.' };
    }
  }

  private async checkSignature(): Promise<SignatureCheckResult> {
    try {
      // Cosign keyless verification against Fulcio/Rekor transparency log
      const cmd = `cosign verify --certificate-identity-regexp=".*" --certificate-oidc-issuer-regexp=".*" ${this.artifactRef}`;
      execSync(cmd, { stdio: 'inherit' });
      return { valid: true, message: 'Artifact signature verified against transparency log.' };
    } catch (error: any) {
      return { 
        valid: false, 
        message: `Cosign verification failed: ${error.message || 'Unknown error'}` 
      };
    }
  }
}

// Usage in CI pipeline
async function main() {
  const artifact = process.env.ARTIFACT_REF || 'ghcr.io/org/app:v1.2.0';
  const validator = new SupplyChainValidator(artifact);
  const passed = await validator.validate();
  process.exit(passed ? 0 : 1);
}

main().catch(err => {
  console.error('Validation runner failed:', err);
  process.exit(2);
});

Architecture Decisions and Rationale

• Keyless Signing over Static Keys: Static signing keys create rotation overhead and secret management risk. Keyless signing (via Sigstore/Cosign) uses OIDC identity from your CI provider, issues short-lived certificates from Fulcio, and logs signatures to Rekor. This eliminates key rotation while maintaining non-repudiation.
• CycloneDX over SPDX: CycloneDX provides richer dependency relationship mapping and built-in support for vulnerability exploitation data (VEX). It integrates natively with Syft, Grype, and modern policy engines.
• SLSA Level 3 as Baseline: Level 3 requires hosted build platforms, build script versioning, and provenance generation. It blocks most CI runner hijacking and ensures reproducible builds. Level 4 (hardware-backed) is reserved for high-assurance environments.
• Policy Enforcement at Admission, Not Just CI: CI gates catch issues early, but deployment-time verification prevents bypasses. Kubernetes OPA/Gatekeeper or Kyverno policies should reject pods referencing unsigned images or missing SBOM annotations.

Pitfall Guide

1. Scanning Only Direct Dependencies Package managers resolve transitive dependencies automatically. Ignoring them leaves 60-80% of your attack surface unmonitored. Always generate full dependency graphs and scan them. Use lockfiles to pin versions and prevent unexpected transitive updates.

2. Treating SBOMs as Compliance Artifacts An SBOM is useless if it sits in a vault. Integrate it into vulnerability scanning, dependency update automation, and runtime attestation. Without active consumption, it generates zero security value.

3. Ignoring Build Environment Integrity A compromised CI runner can inject malicious code before signing occurs. Use ephemeral runners, verify builder images, and enforce SLSA provenance. Never sign artifacts built on shared or unverified infrastructure.

4. Signing Without Verification Policies Cryptographic signatures are meaningless if deployment pipelines don't validate them. Configure admission controllers to reject unsigned or expired certificates. Signing without verification creates false confidence.

5. Over-Scanning Without Triage Workflows Scanners generate noise. Without severity filtering, exploitability scoring, and automated ticketing, engineers will disable checks. Implement CVSS + EPSS scoring, suppress known false positives, and route critical findings to incident response.

6. Assuming Base Images Are Inherently Safe Official container images are not immune to supply chain attacks. They can contain outdated packages, misconfigured permissions, or compromised build layers. Scan base images independently, pin them by digest, and rebuild regularly.

7. Neglecting Developer Tooling Security IDE extensions, local package caches, and pre-commit hooks can be compromised. Enforce hash verification for npm/pip/cargo packages, disable automatic extension updates, and scan developer environments periodically.

Production Best Practices:

• Pin all dependencies to exact versions or SHA256 digests.
• Use private registries with mirroring and vulnerability filtering.
• Automate SBOM generation and attachment to every release artifact.
• Implement VEX (Vulnerability Exploitability eXchange) to declare which CVEs do not apply to your build.
• Rotate CI runner credentials and enforce least-privilege IAM for build service accounts.

Production Bundle

Action Checklist

• Generate CycloneDX SBOM for every build artifact using Syft or native package manager output
• Integrate Grype/Trivy scanning into CI with EPSS-based severity filtering
• Enable SLSA Level 3 provenance generation via GitHub Actions or GitLab CI attestation
• Configure Cosign keyless signing with Fulcio/Rekor for all container images and binaries
• Deploy OPA/Gatekeeper or Kyverno policies to reject unsigned or unattested artifacts at admission
• Implement VEX documents to suppress non-exploitable CVEs and reduce alert noise
• Pin base images and dependencies by digest, not tag, across all environments
• Run quarterly supply chain tabletop exercises simulating CI compromise or dependency hijacking

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Small team, rapid iteration	Keyless Cosign + Grype CI gate + CycloneDX SBOM	Minimal overhead, immediate coverage, scales with team size	Low (free tiers + CI compute)
Enterprise, regulated compliance	SLSA L3 + KMS-backed signing + OPA admission + VEX	Audit-ready provenance, cryptographic non-repudiation, policy enforcement	Medium (HSM/KMS licensing, policy engineering)
High-assurance / critical infrastructure	Hardware-backed builders + SLSA L4 + Rekor transparency + runtime attestation	Blocks nation-state supply chain attacks, ensures full traceability	High (dedicated infrastructure, compliance overhead)
Legacy monolith with unmaintained deps	Private registry mirroring + dependency pinning + container scanning + runtime eBPF monitoring	Reduces attack surface without refactoring, enables safe deployment	Medium (registry costs, monitoring stack)

Configuration Template

GitHub Actions workflow implementing SBOM generation, vulnerability scanning, provenance attestation, and keyless signing.

name: Supply Chain Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  IMAGE: ghcr.io/${{ github.repository }}/app:${{ github.sha }}

jobs:
  build-and-attest:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push Image
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ${{ env.IMAGE }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE }}
          format: cyclonedx-json
          output-file: sbom.json
          attach-checksum: true

      - name: Scan for Vulnerabilities
        uses: anchore/scan-action@v3
        with:
          image: ${{ env.IMAGE }}
          fail-build: true
          severity-cutoff: high

      - name: Generate Build Provenance
        uses: slsa-framework/slsa-github-generator/.github/actions/generate-provenance@v1.9.0
        with:
          subject: ${{ env.IMAGE }}
          output-file: provenance.json

      - name: Sign Artifact
        uses: sigstore/cosign-action@v3.3.0
        with:
          images: ${{ env.IMAGE }}
          upload: true
          annotations: |
            build-id=${{ github.run_id }}
            commit=${{ github.sha }}

Quick Start Guide

1. Install tooling: brew install syft grype cosign (macOS/Linux). Verify with syft version and cosign version.
2. Generate your first SBOM: syft scan dir:. -o cyclonedx-json > sbom.json. Inspect the output to confirm dependency graph accuracy.
3. Scan immediately: grype sbom:sbom.json --fail-on high. Integrate this command into your CI pipeline as a blocking step.
4. Enable keyless signing: In GitHub Actions, request id-token: write permission and run cosign sign --yes <image-ref>. Verify with cosign verify <image-ref>.
5. Enforce at deployment: Add a Kyverno policy or OPA rule that rejects pods referencing images without valid Sigstore signatures. Test with kubectl apply --dry-run=server -f pod.yaml.

Supply chain security is not a product. It is a verification discipline. When every artifact carries a cryptographic fingerprint, every build records its origin, and every deployment enforces policy, you stop guessing and start proving. That is the difference between hope and security.