Software Supply Chain Security: Trust Nothing You Did Not Build (and Verify What You Did)

SolarWinds. Log4Shell. Codecov. The last five years have demonstrated that the software supply chain is the most underprotected attack surface in modern engineering. Securing it requires a shift from trusting artifacts by default to verifying provenance at every stage.

Attack Vector Taxonomy

Supply Chain Attack Vectors
├── Source Code
│   ├── Compromised developer account
│   ├── Malicious commit / pull request
│   ├── Dependency confusion (internal vs public package names)
│   └── Typosquatting (similar package names)
├── Build System
│   ├── Compromised CI/CD pipeline
│   ├── Poisoned build cache
│   ├── Malicious build plugin / action
│   └── Secrets exfiltration from build environment
├── Dependencies
│   ├── Malicious upstream package (event-stream, ua-parser-js)
│   ├── Unmaintained dependency with known CVEs
│   ├── Transitive dependency risk
│   └── Package registry compromise
├── Artifacts
│   ├── Tampered container image
│   ├── Unsigned binary
│   ├── Registry compromise
│   └── Man-in-the-middle during pull
└── Deployment
    ├── Compromised IaC / Helm chart
    ├── Unauthorized deployment (missing approval gate)
    ├── Drift from declared state
    └── Insecure runtime configuration

SLSA Framework Levels

SBOM Format Comparison

Tool Comparison

Secure Pipeline Architecture

┌──────────┐     ┌──────────────┐     ┌──────────────┐
│Developer │────>│ Code Review  │────>│  CI Build    │
│  Commit  │     │  (2+ review) │     │ (ephemeral,  │
│ (signed) │     │  branch prot.│     │  isolated)   │
└──────────┘     └──────────────┘     └──────┬───────┘
                                             │
                    ┌────────────────────────┐│
                    │  SBOM + Provenance     ││
                    │  Generation (syft,     │◄┘
                    │  in-toto, SLSA)        │
                    └───────────┬────────────┘
                                │
                    ┌───────────▼────────────┐
                    │  Signing (Cosign /     │
                    │  Sigstore keyless)     │
                    └───────────┬────────────┘
                                │
                    ┌───────────▼────────────┐
                    │  Artifact Registry     │
                    │  (signed + attested)   │
                    └───────────┬────────────┘
                                │
                    ┌───────────▼────────────┐
                    │  Admission Control     │
                    │  (Kyverno / OPA)       │
                    │  - Verify signature    │
                    │  - Check SBOM          │
                    │  - Enforce SLSA level  │
                    └───────────┬────────────┘
                                │
                    ┌───────────▼────────────┐
                    │  Production Runtime    │
                    │  (continuous scanning) │
                    └────────────────────────┘

Strategic Recommendations

Start with SBOMs. Generating an SBOM for every build is low-effort, high-value. Use syft or Trivy in your CI pipeline. This gives you a baseline inventory before you even start vulnerability scanning.

Sign everything. Cosign with keyless signing (backed by Sigstore's Fulcio and Rekor) eliminates key management overhead. Combine with Kyverno admission policies to enforce "no unsigned images in production."

Pin dependencies aggressively. Lock files are necessary but not sufficient. Pin GitHub Actions to commit SHAs, not tags. Pin base images to digests, not tags.

Adopt SLSA incrementally. Most organizations can reach SLSA 2 within weeks by using GitHub Actions with artifact attestations. SLSA 3 requires more investment in build isolation but dramatically reduces risk.

Resources

• SLSA Framework
• Sigstore Project
• OpenSSF Scorecard
• NIST SSDF (SP 800-218)
• CISA SBOM Resources

:::