Q41: Software Supply Chain Security & SLSA Framework: SBOM generation, container scanning (Trivy), and SAST. - DevOps & Kubernetes (50 Qs)

Securing the Software Supply Chain

Modern attackers frequently target developer tooling and third-party dependencies rather than attacking production firewalls directly. The SLSA (Supply-chain Levels for Software Artifacts) framework provides end-to-end security verification.

scss

[ Source Code ] ---> [ Dependencies ] ---> [ Build Runner ] ---> [ Artifact / Image ] ---> [ Deploy ]
      |                     |                     |                      |                     |
  Git Signing         SBOM (Syft)          Ephemeral Runner        Cosign Signature       Admission Webhook
  & Branch Rules      Trivy Scanner        Isolated Network        Attestation Checks     (Kyverno blocks)

Core Security Layers in CI/CD

SAST (Static Application Security Testing): Scans source code for hardcoded secrets, SQL injection, and buffer overflows using tools like Semgrep or SonarQube.
SCA (Software Composition Analysis): Checks open-source packages in package.json or requirements.txt against known CVE vulnerability databases (Dependabot, Snyk).
SBOM (Software Bill of Materials): A machine-readable inventory of all components, libraries, and licenses embedded in your software. Generated using Syft:

bash

# Generate CycloneDX SBOM
syft registry.example.com/api:v1.0.0 -o cyclonedx-json > sbom.json

Container Image Scanning: Scans OS packages and application dependencies for critical CVEs using Trivy:

bash

# Fail CI build if any CRITICAL vulnerability exists
trivy image --exit-code 1 --severity CRITICAL registry.example.com/api:v1.0.0