# Supply Chain Security

> SBOM generation, CVE scanning, supply chain attack detection, license compliance, dependency pinning, and artifact verification.

- Skill: `irahardianto/supply-chain-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add irahardianto/supply-chain-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/irahardianto/supply-chain-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: irahardianto (https://skillmd.com/u/irahardianto)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/irahardianto/supply-chain-security

---


# Supply Chain Security Principles

Guidelines for securing the software supply chain.

## When to Invoke
- Auditing project dependencies
- Setting up CVE scanning in CI/CD
- License compliance review
- Responding to supply chain vulnerability disclosures

## Dependency Security

### CVE Scanning

| Language | Tool | Command |
|---|---|---|
| Go | `govulncheck` | `govulncheck ./...` |
| Rust | `cargo audit` | `cargo audit` |
| Python | `pip-audit` | `pip-audit` |
| Node.js | `npm audit` | `npm audit` |
| Java | OWASP Dependency-Check | `mvn dependency-check:check` |
| .NET | Built-in | `dotnet list package --vulnerable` |
| Ruby | `bundle audit` | `bundle audit check --update` |
| PHP | `composer audit` | `composer audit` |

### Scanning Frequency
- **Every CI run** — fail build on critical/high CVEs
- **Weekly scheduled scan** — catch newly disclosed vulnerabilities
- **On dependency update** — verify new version is clean

## SBOM (Software Bill of Materials)

### Generation
```bash
# CycloneDX format (recommended)
# Go
cyclonedx-gomod mod -json -output sbom.json

# Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# Python
cyclonedx-py poetry --format json -o sbom.json
```

### Usage
- Attach SBOM to releases
- Track all transitive dependencies
- Enable downstream vulnerability analysis

## License Compliance

### Risk Levels
| License | Risk | Action |
|---|---|---|
| MIT, BSD, Apache 2.0 | Low | Permissive — generally safe |
| LGPL | Medium | Review linking requirements |
| GPL | High | Copyleft — may require source disclosure |
| AGPL | Critical | Network copyleft — consult legal |
| No license | Critical | Cannot use — no rights granted |

### Automation
- Use `license-checker` (Node.js), `pip-licenses` (Python), `cargo-license` (Rust)
- Maintain allowlist/denylist of approved licenses
- Fail CI on disallowed licenses

## Supply Chain Attack Prevention

1. **Lock files committed** — `package-lock.json`, `go.sum`, `Cargo.lock`, `poetry.lock`
2. **Pin exact versions** in production — no floating ranges
3. **Verify checksums** — lock files contain integrity hashes
4. **Review new dependencies** — check maintainer, downloads, last commit, open issues
5. **Minimal dependencies** — each dep = increased attack surface
6. **Signed commits and releases** — verify artifact provenance

## Related
- Dependency Management Principles @.gemini/skills/dependency-management-principles/SKILL.md
- Security Principles GEMINI.md § Security Principles
- Security Mandate GEMINI.md § Security Mandate