Supply Chain Security: SLSA, SBOM and Sigstore for Production Artifacts

The hardest audit question today is not "does the code have CVEs?" but "how do you prove the artifact running in production was built from this exact source, untampered?".

Three common supply chain attacks

• Dependency confusion / typosquat (npm, pypi, RubyGems): publishing packages with names close to internal libraries.
• Source compromise (xz utils, Codecov bash uploader): injecting malicious code into upstream projects.
• Build poisoning (SolarWinds): compromising the build server to inject artifacts while source code remains clean.

The standard response framework is SLSA (Supply-chain Levels for Software Artifacts), maintained by OpenSSF.

SLSA — four levels of build integrity

Level	Key requirements
L1	Documented build, basic provenance generated.
L2	Build runs on hosted CI, signed provenance, source under version control.
L3	Isolated/hardened build environment, provenance can't be forged by users.
L4	Hermetic, reproducible build, two-party review.

Realistic target for most organisations: SLSA Build L2-L3. L4 is still rare and expensive.

SBOM: CycloneDX or SPDX?

• CycloneDX (OWASP): security-focused, supports vulnerabilities, services, ML models. Rich tool ecosystem (Trivy, Syft, Dependency-Track).
• SPDX (Linux Foundation): license-compliance-focused, accepted by many regulators (US EO 14028).

Pick one as primary, export to the other when needed. Every production artifact must have an SBOM auto-generated in CI and stored alongside the artifact.

Sigstore: keyless signing for any artifact

Three components:

• Cosign: CLI to sign/verify images, blobs, attestations.
• Fulcio: CA issuing short-lived certificates based on OIDC identity (5-minute TTL).
• Rekor: immutable transparency log of every signature — useful to detect rogue signatures using your identity.

Biggest benefit: no private keys to store, rotate or back up.

Provenance & in-toto attestations

Provenance is metadata describing who built it, from what source, with what tools, when. The standard format is in-toto attestation with predicate type https://slsa.dev/provenance/v1.

GitHub Actions has an official generator:

jobs:
  build:
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    # ... build & push image
provenance:
needs: [build]
permissions:
id-token: write
packages: write
contents: read
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
image: ghcr.io/org/app
digest: ${{ needs.build.outputs.digest }}
registry-username: ${{ github.actor }}

This workflow builds in an isolated reusable workflow, generates provenance, and signs with Cosign keyless — reaching SLSA L3 with no extra code.

Verifying provenance before deploy

With cosign verify-attestation:

cosign verify-attestation --type slsaprovenance \
  --certificate-identity-regexp "https://github.com/org/.+/.github/workflows/build.yml@.+" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/org/app@sha256:...

Or enforce in-cluster via Kyverno verifyImages with the OIDC subject as attestor. Pods get rejected at admission if the image lacks valid provenance.

Smart dependency management

• Pin by digest/lockfile: package-lock.json, poetry.lock, go.sum. Never latest.
• Pin GitHub Actions by SHA, not tag — tags can be moved.
• Mirror internal packages in Artifactory/Nexus instead of pulling directly from public npm/pypi.
• Renovate/Dependabot with policy: auto-merge patches, manual review for minor/major, with a cooldown to avoid the freshly-published malicious version.

Short supply chain checklist

• Every production artifact has a CycloneDX/SPDX SBOM, stored.
• Images are Cosign keyless signed, signatures stored in Rekor.
• Builds run in isolated reusable workflows (SLSA L2-L3).
• Cluster verifies signature + provenance before admitting a pod.
• Dependencies pinned by lockfile + digest, mirrored internally.
• Dependency-Track follows the long tail of CVEs through SBOMs.

Conclusion

Supply chain security is no longer optional — the EU CRA, US EO 14028 and many enterprise customers already require SBOMs and signed artifacts in RFPs. The good news: the open Sigstore + SLSA + CycloneDX stack lets you reach SLSA L3 at near-zero cost via OpenSSF reusable workflows. Treat it as a non-negotiable technical baseline in 2026.