sbom-supply-chain

# Skill: SBOM & Supply Chain Security > **Expertise:** Syft/Trivy SBOM generation, cosign SBOM attestation, SLSA provenance, dependency pinning, OCI attestations. ## When to load When generating SBOMs for images, attaching attestations to OCI registry, verifying supply chain integrity, or achieving SLSA compliance. ## SBOM Generation (Syft) ```bash # Generate CycloneDX SBOM from image (OCI) syft registry.example.com/myorg/order-service:v1.2.3 \ -o cyclonedx-json=sbom.cdx.json # Generate SPDX SBOM from image syft registry.example.com/myorg/order-service:v1.2.3 \ -o spdx-json=sbom.spdx.json # Generate from local directory (during build) syft dir:. -o cyclonedx-json=sbom.cdx.json # Generate from Dockerfile build context (before push) syft packages docker:myimage:latest -o cyclonedx-json=sbom.cdx.json ``` ## SBOM Attestation via cosign ```bash # Sign image and attach SBOM as OCI attestation # Step 1: Build and push image docker buildx build --push \ -t registry.example.com/myorg/order-service:v1.2.3 . # Step 2: Get digest DIGEST=$(crane digest registry.example.com/myorg/order-service:v1.2.3) # Step 3: Generate SBOM syft registry.example.com/myorg/order-service:v1.2.3 \ -o cyclonedx-json=sbom.cdx.json # Step 4: Attach SBOM as attestation (Sigstore keyless) cosign attest \ --predicate sbom.cdx.json \ --type cyclonedx \ registry.example.com/myorg/order-service@${DIGEST} # Step 5: Verify attestation exists cosign verify-attestation \ --type cyclonedx \ ...