Software Supply Chain Security: SBOMs, SLSA, and Sigstore

# Using Syft (Anchore) - supports multiple ecosystems# For container images# For container images# For container images# For container images# For container images# For container images# Using Trivy (Aqua Security)# Using Trivy (Aqua Security)# Using Trivy (Aqua Security)# Using cdxgen (CycloneDX generator)# Using cdxgen (CycloneDX generator)# Using cdxgen (CycloneDX generator)# GitHub Actions - automatic SBOM generation# Add to your workflow:# Add to your workflow:o your workflow:
- name: Generate SBOM
  uses: anchore/sbom-action@v0
  with:
    path: ./
    format: cyclonedx-json
    output-file: sbom.cdx.json

# GitHub Actions workflow for SLSA Level 3 provenance
name: SLSA Provenance
on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Build artifact
        id: build
        run: |
          # Your build commands here
          make build
          echo "digest=$(sha256sum ./dist/app | cut -d' ' -f1)" >> $GITHUB_OUTPUT
      
      - uses: actions/upload-artifact@v4
        with:
          name: my-artifact
          path: ./dist/app

  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
    with:
      base64-subjects: "${{ needs.build.outputs.digest }}"
      upload-assets: true

# Install Cosign# or download from https://github.com/sigstore/cosign/releases# Keyless signing (uses OIDC identity)# This will:# This will:# This will:# This will:# This will:# This will:# This will:# 1. Open a browser for OIDC authentication# 2. Generate a short-lived certificate from Fulcio# 3. Sign the image and push signature to the registry# 4. Record the signing event in Rekor transparency log# Sign with SBOM attestation# Verify a signed image# Verify a signed image# Verify a signed image# Verify a signed image# Verify a signed image# Verify with policy# Verify with policy# Verify with policy# Verify with policy# Verify with policy# Verify with policy# Verify with policy# Verify with policy# Verify with policypolicy
cosign verify ghcr.io/myorg/myimage:v1.0.0 \
  --certificate-identity-regexp ".*@myorg\.com" \
  --certificate-oidc-issuer https://accounts.google.com

# GitHub Actions workflow for signing
name: Build and Sign
on:
  push:
    branches: [main]

jobs:
  build-and-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for OIDC
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3
      
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Build and push
        id: build
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:latest
      
      - name: Sign the image
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
      
      - name: Generate and attach SBOM
        run: |
          syft packages ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }} \
            -o cyclonedx-json > sbom.cdx.json
          
          cosign attest --yes --predicate sbom.cdx.json \
            --type cyclonedx \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

# Kyverno policy to require signed images
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: verify-signature
    match:
      any:
      - resources:
          kinds:
          - Pod
    verifyImages:
    - imageReferences:
      - "ghcr.io/myorg/*"
      attestors:
      - entries:
        - keyless:
            subject: "*@myorg.com"
            issuer: "https://accounts.google.com"
            rekor:
              url: https://rekor.sigstore.dev

# Scan dependencies with Trivy# Scan container images# Scan container images# Scan with Grype (Anchore)# Scan with Grype (Anchore)# GitHub Dependabot configuration (.github/dependabot.yml)# GitHub Dependabot configuration (.github/dependabot.yml)ml)
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    groups:
      production-dependencies:
        patterns:
          - "*"
        exclude-patterns:
          - "@types/*"
          - "*eslint*"
          - "*jest*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"