# Supply Chain Security

> When to activate: supply chain security, SBOM, dependency pinning, Sigstore, Cosign, provenance attestation, SLSA framework, software bill of materials

- Skill: `mattakushi432/supply-chain-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/supply-chain-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/supply-chain-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/supply-chain-security

---

# Supply Chain Security Patterns

## Dependency Pinning

```bash
# requirements.txt — pin exact versions + hashes
pip-compile --generate-hashes requirements.in > requirements.txt
# Result:
# cryptography==42.0.5 \
#     --hash=sha256:6d0fbe82a65d3... \
#     --hash=sha256:9a8d6802e0825...

# Install with hash verification
pip install --require-hashes -r requirements.txt
```

```json
// package.json — use exact versions, lockfile
{
  "dependencies": {
    "express": "4.18.2"     // Exact, not ^4.18.2
  }
}

// .npmrc — enforce lockfile
save-exact=true
package-lock-only=false
```

```toml
# Cargo.lock committed — pin all transitive deps
# Cargo.toml
[dependencies]
tokio = { version = "=1.36.0", features = ["full"] }   # Exact version pin
```

## SBOM Generation

```bash
# Syft — generate SBOM from image or directory
brew install syft

# CycloneDX format (preferred)
syft myapp:latest -o cyclonedx-json > sbom.cyclonedx.json

# SPDX format
syft myapp:latest -o spdx-json > sbom.spdx.json

# Scan SBOM for vulnerabilities with Grype
grype sbom:sbom.cyclonedx.json

# Python — pip-licenses
pip install pip-licenses
pip-licenses --format=json --with-urls > licenses.json

# Node — cyclonedx
npm install -g @cyclonedx/cyclonedx-npm
cyclonedx-npm --output-file sbom.json
```

## Image Signing with Cosign

```bash
# Install cosign
brew install cosign

# Generate key pair
cosign generate-key-pair

# Sign image after push
cosign sign --key cosign.key myregistry.io/myapp:v1.0.0

# Verify before deploy
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0

# Keyless signing (uses OIDC — preferred in CI)
cosign sign myregistry.io/myapp:v1.0.0  # Uses GitHub/Google OIDC

# Verify keyless
cosign verify \
  --certificate-identity-regexp "https://github.com/myorg/myrepo" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  myregistry.io/myapp:v1.0.0
```

## Provenance Attestation (SLSA)

```yaml
# GitHub Actions — generate SLSA provenance
name: Build and Attest

on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      attestations: write

    steps:
    - uses: actions/checkout@v4

    - name: Build image
      run: |
        docker build -t myapp:${{ github.sha }} .
        docker push myregistry.io/myapp:${{ github.sha }}

    - name: Attest build provenance
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: myregistry.io/myapp
        subject-digest: sha256:${{ steps.push.outputs.digest }}
        push-to-registry: true

    # Verify attestation
    - name: Verify provenance
      run: |
        gh attestation verify oci://myregistry.io/myapp:${{ github.sha }} \
          --owner myorg
```

## SLSA Levels

```
SLSA Level 1 — Documented build process:
  ✓ Build script exists
  ✓ SBOM generated
  ✓ Provenance available (unsigned)

SLSA Level 2 — Build service:
  ✓ Version controlled source
  ✓ Hosted build service (GitHub Actions, Cloud Build)
  ✓ Signed provenance

SLSA Level 3 — Hardened builds:
  ✓ Source integrity (two-party review)
  ✓ Hermetic/isolated build environment
  ✓ Non-falsifiable provenance
  ✓ Reproducible builds

SLSA Level 4 — Two-person reviewed:
  ✓ 4-eyes principle on all changes
  ✓ Hermetic, reproducible builds verified
```

## Admission Control (Kubernetes)

```yaml
# Kyverno policy — require signed images
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-signed-images
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-image-signature
    match:
      resources:
        kinds: [Pod]
    verifyImages:
    - imageReferences: ["myregistry.io/*"]
      attestors:
      - entries:
        - keyless:
            subject: "https://github.com/myorg/*"
            issuer: "https://token.actions.githubusercontent.com"
```

## Checklist

```
Dependencies:
  ✓ All deps pinned to exact versions with hashes
  ✓ Lockfiles committed (package-lock.json, Cargo.lock, poetry.lock)
  ✓ Dependency updates automated via Dependabot/Renovate
  ✓ Vulnerability alerts enabled on repo

Build:
  ✓ Builds run in ephemeral, isolated environments
  ✓ Build inputs (source + deps) fully declared
  ✓ SBOM generated and attached to release artifacts
  ✓ Images signed with Cosign

Distribution:
  ✓ Provenance attestation attached to artifacts
  ✓ Admission controller verifies signatures before deploy
  ✓ Private registry with access control (no public pull)
  ✓ Artifact retention policy defined
```