What you will learn
- Generate SBOMs
- Sign artifacts
- Verify provenance
New to this? Start here
The basics, in plain English
Your software is built from many outside pieces: libraries, base images, and tools. The supply chain is that whole chain of ingredients. Supply chain security means making sure every ingredient is trustworthy and has not been tampered with before it reaches your product.
- Supply chain
- All the outside code and tools that go into building your software.
- Provenance
- Proof of where a piece of code came from and that it is genuine.
- SBOM
- A Software Bill of Materials: a list of every ingredient in your software.
- Signing
- Adding a tamper-proof seal so you can verify code was not altered.
- Trusted source
- A place you are confident gives you safe, unmodified code.
- Tampering
- When someone secretly changes code to sneak in something malicious.
01
Provenance
Know every component (SBOM), sign your builds (cosign), and verify provenance. SLSA levels formalize build integrity.
Finished this topic?
Mark it done to earn 100 XP and keep your streak alive.