Supply Chain Security

Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

Supply Chain Security Testing

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-pentest.md — confirm this skill's operations are pre-authorized routine operations
2. NOW: Confirm whether the current task falls within this skill's scope
3. NEXT: Read ../tool-index.md, validate tool availability and actual paths
4. NEXT: If tools are missing, invoke bootstrap — do not guess paths
5. ACT: Enter step one of the "Workflow" and execute; do not stop at a confirmation state

SBOM / SCA / CI/CD pipelines / dependency provenance Regulation-driven: US Executive Order SBOM, Chinese national standards, EU CRA

Applicable Scenarios

• Software supply chain security assessment
• Open-source dependency vulnerability scanning and verification
• CI/CD pipeline security auditing
• Container image security analysis
• Third-party component compliance review
• Build artifact provenance and integrity verification

Six-Layer Supply Chain Governance Framework

Layer 1: Source code trust assessment → upstream repository/maintainer/release history review
Layer 2: Build pipeline integration → CI/CD security gates, signature verification
Layer 3: Artifact distribution integrity → signing, checksums, SBOM attachment
Layer 4: Runtime protection → container scanning, admission control
Layer 5: Continuous monitoring → real-time CVE tracking, vulnerability reachability analysis
Layer 6: Incident response → supply chain attack handling, rollback strategy

Workflow

1. SBOM generation and audit

Generate SBOM:
□ CycloneDX format: cdxgen → bom.json
□ SPDX format: sbom-tool generate
□ Syft: syft <image|dir> -o spdx-json

Audit points:
□ Are there unknown/unauthorized dependencies
□ Are there deprecated/unmaintained packages
□ License conflict detection
□ Direct vs transitive dependency inventory
□ Release timeline and maintainer status of each component

2. Software Composition Analysis (SCA)

# OSV-Scanner (free, maintained by Google)
osv-scanner scan -r . --format json

# OWASP Dependency-Track (enterprise-grade continuous monitoring)
docker run -p 8080:8080 dependencytrack/apiserver
# → upload SBOM → auto-match NVD/OSV/GitHub Advisory

# Snyk (commercial)
snyk test --all-projects
snyk monitor  # continuous monitoring

# Trivy (container + dependency + IaC)
trivy fs .          # filesystem scan
trivy image nginx   # container image
trivy config .      # IaC configuration

3. Vulnerability reachability verification

SCA alerts ≠ actual risk! Only ~15% of alerts from most SCA tools are actually reachable.

Verification steps:
1. Get the CVE list with Dependency-Track or Trivy
2. Filter for CVSS ≥ 7.0 vulnerabilities
3. Perform reachability analysis on CVEs that have PoCs
   - Code Property Graph slicing: trace the path from user input to the vulnerable function
   - DEPTEX method: EPD (Execution Path Dominance) + LLM semantic verification
4. Verify PoCs in an isolated environment
5. Prioritize remediation by actual impact for reachable vulnerabilities

Tool references:

• CodeQL: GitHub code queries → data flow analysis
• Snyk Code: reachability flagging
• DEPTEX: LLM-assisted context-aware risk assessment

4. CI/CD pipeline security

Security checkpoints:
□ Code commit → pre-commit hook: gitleaks (secret scanning)
□ PR stage → SCA scan (Trivy/OSV-Scanner)
□ Build stage → artifact signing (cosign)
□ Push stage → SBOM attachment (syft + attest)
□ Deploy stage → admission control (OPA/Kyverno + image scanning)
□ Runtime → continuous vulnerability monitoring (Dependency-Track)

Pipeline's own security:
□ Pipeline as Code audit (GitHub Actions / GitLab CI configuration injection)
□ Runner isolation (prevent malicious builds from breaking out of the container)
□ Secret management (Actions Secrets / Vault, no hardcoding)
□ Third-party Action review (pin commit SHA, not tag)

5. Container image security

# Dockerfile audit
hadolint Dockerfile

# Image scanning (multi-layer: OS + app dependencies + config)
trivy image --severity HIGH,CRITICAL nginx:latest

# Minimal base images
# Prefer: distroless → alpine → slim → avoid latest
docker scout quickview nginx:latest

# Image signing
cosign sign --key cosign.key myimage:tag
cosign verify --key cosign.pub myimage:tag

6. Third-party dependency review

New dependency checklist:
□ Maintenance status: commits in the last 6 months? maintainer activity?
□ Security history: any malicious code implanted in the past?
□ Dependency tree: how many transitive dependencies are introduced?
□ License: compatible with the project's license?
□ Alternatives: is there a safer alternative (Snyk Advisor / Socket.dev scores)?

Risk assessment matrix:
  High maintenance × low dependency count × compatible license → low risk
  Low maintenance × high dependency count × license conflict → high risk

Toolchain

References

• references/sbom-sca-methodology.md — SBOM + SCA methodology
• references/cicd-pipeline-security.md — CI/CD pipeline security audit

Task Completion Self-Check (MUST pass before claiming completion)

• Did I execute every step of the workflow (rather than just reading it)?
• Did I use real tool paths based on tool-index?
• Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
• Did I complete and write back the Checklist items required by RULES?