Cybersecurity · advanced
Software Supply-Chain Guard: SBOM, Signing, and Provenance in CI
A CI pipeline that produces a signed container image with a software bill of materials, SLSA provenance attestation, and a vulnerability scan on every build — and a deployment gate that refuses any image without a valid signature. The defenses against the attack class behind the biggest incidents of recent years.
Project overview
Supply-chain compromise — poisoned dependencies, tampered build artifacts — drove the most damaging breaches of the last two years, and regulators now require SBOMs for software sold to government. DevSecOps roles want someone who has actually wired signing and verification end to end.
Real-world use case
A company ships containers to customers who must prove what is inside them. Every release carries a signed SBOM and provenance, and the cluster rejects any image that was not built by the official pipeline.
Tools and technologies
- GitHub Actions
- Syft
- Trivy
- Cosign / Sigstore
- SLSA Provenance
- Kyverno or OPA
Skills you can demonstrate
Supply-Chain Security, Artifact Signing and Verification, SBOM Generation, Policy Enforcement, DevSecOps Pipelines
Build roadmap
- Build and scan
A workflow that builds a container image, pushes it to a registry, and runs Trivy. Fail the build on critical vulnerabilities to set the baseline. - Generate the SBOM
Add Syft to produce an SPDX or CycloneDX SBOM and upload it as a build artifact. Open it and understand what is inside your image. - Sign keylessly with Cosign
Use the workflow’s OIDC token to sign the image with Sigstore. Verify the signature locally and find your entry in the transparency log. - Attach attestations
Attach the SBOM and a SLSA provenance attestation to the image. Verify both with Cosign and inspect the provenance to see the builder identity. - Gate the cluster
Install Kyverno on a kind cluster and write an image-verification policy pinned to your workflow identity. Deploy a signed image (allowed) and an unsigned one (rejected). - Document the chain
A README with a diagram from source to running pod, the verification commands, and a plain-language explanation of which attack each control stops.
Ways to extend the project
Add a policy that also rejects images whose SBOM contains a package with a critical CVE, so the gate enforces both authenticity and vulnerability posture.
How to showcase your work
- GitHub: The workflow, the policy, and a README showing the verification commands succeeding on your image and failing on an unsigned one.
- LinkedIn: Show the rejection: deploy an unsigned image and watch the admission controller block it with the policy message.
- Resume: Name the standards: "Implemented SLSA provenance, Sigstore keyless signing, and SBOM attestation with admission-time verification."