Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
Cloud, Container and Supply Chain Security  ›  Lesson

Supply Chain Security and SBOMs

Supply Chain Security 12 minSoftware supply chain security protects everything that goes into a build: pinned and verified dependencies, an SBOM listing every component, and signed provenance showing how the artifact was made.

Supply Chain Security and SBOMs

Tiffin's code is small; its dependencies are not. A fresh build pulls hundreds of packages written by strangers, plus a base image, pipeline plugins and build tools. Attackers have noticed: instead of breaking into one company, they poison a popular package and let everybody's pipeline install it for them. That is a supply chain attack.

The rule

Know what's in it, pin where it came from, prove how it was built.

Know what's in it: the SBOM. A software bill of materials is a machine-readable list of every component in an artifact, with names, versions and licences. The two common formats are SPDX and CycloneDX. Generate one for every image the pipeline releases and keep it with the image.

sbom-tool generate tiffin@sha256:<digest> --format cyclonedx > tiffin.cdx.json

When the next bad library is announced, "are we affected?" becomes a search instead of a week of guessing.

Pin where it came from.

  • Commit lockfiles that fix exact versions and, where the tool supports it, content hashes. A new version enters only through a reviewed change.
  • Pull packages through a proxy registry you control, and be precise about package names and sources: attackers publish look-alike names (typosquatting) and public packages with the same name as private ones (dependency confusion).
  • Review new dependencies briefly: is it maintained, widely used, and really needed?

Prove how it was built. Provenance is a signed record of which source commit, which pipeline and which steps produced an artifact. SLSA (Supply-chain Levels for Software Artifacts) is a framework that grades how trustworthy that build process is. Together with signing (for example with Sigstore's cosign), the cluster can refuse anything that was not built by Tiffin's pipeline from Tiffin's repository.

The shortcut

For any component, ask three questions: What is it? Where did it come from? Who built it, and can they prove it?

"Library X version 4.2.1 was malicious"Step 1 of 4

  1. What is it: search the SBOMs

    Search every released image's SBOM for X 4.2.1. Two older images contain it; the current one does not.

Drills

Answer fast — trust the rule.

quick drill

What is an SBOM?

quick drill

An attacker publishes reqeusts hoping someone mistypes requests. What is this called?

quick drill

Why commit lockfiles with exact versions and hashes?

quick drill

What does signed build provenance let the cluster check?

Remember

  • Know what's in it, pin where it came from, prove how it was built.
  • SBOM = what is in it; lockfile = where it came from; provenance = who built it.
  • Poisoned inputs pass through honest pipelines; review and pin what goes in.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainThe morning a library went bad

A popular logging library announces that one of its versions was published by an attacker who stole a maintainer's account. Explain how an SBOM, lockfiles and pinning, and signed provenance would each help Tiffin answer 'are we affected, and can we trust what we ship?'.