Skip to main content

Dependency Inventory, Lockfiles, and SBOM

What This Concept Is​

This lesson teaches you to resolve direct and transitive components reproducibly and describe shipped software in machine-readable inventories. Supply-chain security establishes a verifiable path from reviewed source through controlled build and signed artifact to authorized workload. Every assurance claim must point to evidence and a verifier.

Why It Matters Here​

Attackers target developer identities, dependencies, workflows, registries, build runners, deployment permissions, and platform defaults because one compromise can reach many systems. Integrity at one stage cannot compensate for an untrusted adjacent stage.

Concrete Example​

Apply the mechanism to a containerized service built from a protected repository and deployed to Kubernetes. Introduce one authorized tampering or privilege flaw, observe whether provenance and admission detect it, contain the path, and preserve before-and-after evidence.

Common Confusion / Misconception​

A common mistake is treating an SBOM, signature, scanner, lockfile, or SLSA level as security by itself. Each answers a bounded question. Verify identity, trustworthy build facts, artifact digest, policy, reachability, exception state, and the environment actually running the artifact.

How To Use It​

  1. Map source, dependency, build, registry, promotion, and runtime trust.
  2. Assign separate identities and minimum permissions.
  3. Pin and inventory every build input.
  4. isolate untrusted code and protect secrets.
  5. Produce signed provenance for immutable artifacts.
  6. Verify policy at promotion and admission.
  7. Rehearse revocation, rebuild, and compromise response.

Check Yourself​

  1. Which principal can alter the shipped artifact without review?
  2. What evidence links running bytes to source and builder?
  3. Can pull-request code access a release secret?
  4. How is a compromised artifact revoked and replaced?

Mini Drill or Application​

Build one immutable artifact, produce an SBOM and signed provenance, then attempt to deploy a modified or unverifiable copy. Capture the denial. Add one time-limited exception, verify its approval and expiry, and demonstrate clean rebuild and promotion.

Read This Only If Stuck​