moai-ref-supply-chain

Generate an SBOM at build time using syft, which emits both SPDX and CycloneDX formats from an artifact or source tree. Include the NTIA minimum elements, especially dependency relationships, and attach the SBOM as a signed attestation so consumers can trust it.

SPDX, stewarded by the Linux Foundation and standardized as ISO/IEC 5962, is license-centric with broad regulatory acceptance. CycloneDX, from OWASP, is security-centric with native vulnerability and dependency-relationship modeling. Pick based on ecosystem fit and consumer needs.

Prevent dependency confusion by reserving your organization's namespace on public registries, configuring resolvers to fetch internal names only from the internal registry, and pinning every dependency to a content hash in the lockfile so same-name substitutions fail verification.

Production environments typically require signed provenance at SLSA Build L2 or higher, where provenance comes from a hosted build platform and is tamper-evident via signing. High-assurance environments require L3, which adds isolated, ephemeral builders and non-forgeable provenance.

Cosign keyless signing authenticates the signer via OIDC, issues a short-lived identity-bound certificate, and records the signature in a public transparency log. Consumers verify with cosign verify, pinning the expected certificate identity and OIDC issuer so wrong-identity artifacts are rejected.

Version pinning without hash pinning still accepts substituted bytes published under the same version string. Pinning by content hash in the lockfile ensures a same-version substitution with different bytes fails the install-time integrity check regardless of which registry served it.