1# GitHub Actions: Generate SBOM for every build
2- name: Build Docker image
3  run: docker build -t myapp:${GITHUB_SHA} .
4 
5- name: Generate SBOM with Syft
6  run: |
7    curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
Syft scans the built image and generates a machine-readable SBOM
8    syft myapp:${GITHUB_SHA} -o spdx-json > sbom.spdx.json
9    syft myapp:${GITHUB_SHA} -o cyclonedx-json > sbom.cyclonedx.json
10 
11- name: Scan for CVEs with Grype (using the SBOM)
Grype uses the SBOM to scan for CVEs — --fail-on high blocks deployment
12  run: |
13    grype sbom:./sbom.spdx.json --fail-on high
14 
15- name: Attach SBOM to image (Cosign attestation)
Cosign attaches the SBOM to the image in the registry — it travels with the artifact
16  run: |
17    cosign attach sbom --sbom sbom.spdx.json myapp:${GITHUB_SHA}
18 
19- name: Push image with SBOM attestation
20  run: docker push myapp:${GITHUB_SHA}

1#!/bin/bash
2# When CVE-2021-44228 (Log4j) announced:
3# Query: Which builds contain log4j with version < 2.17.1?
4 
5# If SBOMs stored in Dependency-Track SBOM server:
SBOM query returns affected services in seconds — not weeks of manual searching
6curl -X GET "https://dtrack.example.com/api/v1/bom/search?name=log4j&version=2.17.0" \
7  -H "X-API-Key: $API_KEY"
8 
9# Returns instantly:
Structured response: exact services, exact versions — actionable immediately
10# [
11#   { "project": "auth-service", "affectedComponent": "log4j:2.14.1" },
12#   { "project": "api-gateway", "affectedComponent": "log4j:2.14.1" },
13#   ... 45 more services
14# ]
15# Total: 47 services need patching. You know EXACTLY which ones.
16 
Without SBOM: manual grep misses transitive deps — some services remain vulnerable
17# Without SBOM: grep through 500 repos, miss transitive deps, leave 12 unpatched

1#!/bin/bash
2# 1. Generate signing keys (once — store private key in HSM or Vault)
3cosign generate-key-pair
4# Outputs: cosign.key (private), cosign.pub (public)
5# Best practice: use Sigstore keyless signing in CI to avoid key management
6 
7# 2. Sign image in CI/CD pipeline after building
Sign immediately after build — before push to registry
8cosign sign --key cosign.key myregistry/myapp:latest
9# Signature stored in container registry alongside the image
10 
11# 3. Generate SLSA provenance (links artifact to source commit + build pipeline)
12# In GitHub Actions, use slsa-github-generator
13# Provenance proves: "built from commit abc123 by pipeline X"
14 
Verify at deploy: this is the gate that stops tampered images from running
15# 4. Verify at deploy time (or in Kubernetes admission controller)
16cosign verify --key cosign.pub \
17  --certificate-github-workflow-repository myorg/myrepo \
18  myregistry/myapp:latest
19 
Provenance check: verifies the image was built from the expected commit and pipeline
20# 5. Verify provenance
21cosign verify-attestation --key cosign.pub \
22  --type slsaprovenance \
23  myregistry/myapp:latest | jq .
Non-zero exit code = gate fails = pod never scheduled
24 
25# If signature invalid or provenance mismatch -> reject the image
26if [ $? -ne 0 ]; then
27  echo "❌ Verification failed. Image rejected."
28  exit 1
29fi
30echo "✅ Signature and provenance verified. Deploying."