Software Supply Chain Security: Vulnerability Scanning, SBOM, and Cosign

Securing the software supply chain ensures that container images and application artifacts are verified, free of critical vulnerabilities (CVEs), traceable through a Software Bill of Materials (SBOM), and cryptographically signed using Cosign (Sigstore) before running in production.

⚡ Quick Dive

Supply Chain Security Lifecycle

[ Developer Commit ] ──► [ Build Container ] ──► [ Security Scan (Trivy) ] ──► [ Generate SBOM (Syft) ]
                                                                                       │
[ Deploy to K8s ] ◄── [ Verify Signature (Kyverno) ] ◄── [ Sign Image (Cosign) ] ◄────┘

Essential Tooling Cheat Sheet

Task Command / Tool Example
Vulnerability Scan trivy image <imgTag> trivy image --severity HIGH,CRITICAL myapp:v1.0
Generate SBOM (SPDX) syft <imgTag> -o spdx-json syft myapp:v1.0 -o spdx-json=sbom.spdx.json
Sign Image cosign sign <imgTag> cosign sign --key cosign.key myregistry/myapp:v1.0
Verify Signature cosign verify <imgTag> cosign verify --key cosign.pub myregistry/myapp:v1.0
Attach SBOM to Registry cosign attach sbom cosign attach sbom --sbom sbom.spdx.json myregistry/myapp:v1.0

📖 Extended Guide

1. Automated Vulnerability Scanning with Trivy

Integrate security scanning into CI/CD pipelines to block builds containing critical vulnerabilities:

# GitHub Actions Step
- name: Run Trivy Vulnerability Scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'ghcr.io/${{ github.repository }}:${{ github.sha }}'
    format: 'table'
    exit-code: '1' # Fail pipeline if vulnerabilities found
    ignore-unfixed: true
    severity: 'CRITICAL,HIGH'

2. Software Bill of Materials (SBOM) with Syft

An SBOM is a formal, machine-readable inventory of all third-party libraries, OS packages, licenses, and dependencies contained within a software artifact (SPDX or CycloneDX standard).

# Generate CycloneDX JSON SBOM for a container image
syft packages alpine:latest -o cyclonedx-json > alpine-sbom.json

# Scan an existing SBOM file for newly published zero-day CVEs
grype sbom:./alpine-sbom.json

3. Cryptographic Image Signing with Cosign (Sigstore)

Cosign attaches cryptographic signatures to OCI artifacts stored in standard container registries (without requiring a separate signature database):

Key-Based Signing Workflow:

# 1. Generate a Cosign keypair
cosign generate-key-pair

# 2. Sign the container image in the registry
cosign sign --key cosign.key myregistry.com/app:v1.0.0

# 3. Verify signature in CI or deployment script
cosign verify --key cosign.pub myregistry.com/app:v1.0.0

Kubernetes Admission Policy Enforcement (Kyverno):

Reject any pod whose image does not carry a valid cryptographic signature from your release key:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-signature
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
      - imageReferences:
        - "myregistry.com/*"
        attestors:
        - entries:
          - keys:
              publicKeys: |-
                -----BEGIN PUBLIC KEY-----
                MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
                -----END PUBLIC KEY-----
⌂ All Guides