skills.rest
BagelHole
BagelHoleCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sbom-supply-chain

Generate, sign, and verify SBOMs and provenance attestations with Syft, Grype, and Cosign.

46|4|Updated Jan 27, 2026
Search Tags:#provenance#supply chain security#slsa#sbom#cosign#artifact signing
One-click install
npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill sbom-supply-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom-supply-chain
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/scanning/sbom-supply-chain
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill sbom-supply-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical need for trust and transparency in the software supply chain by enabling the generation, signing, and verification of Software Bill of Materials (SBOMs) and provenance attestations.

Core Features & Use Cases

  • SBOM Generation: Create SBOMs in standard formats (SPDX, CycloneDX) for container images and application builds.
  • Attestation & Signing: Generate provenance attestations for build artifacts and sign them using tools like Cosign.
  • Verification: Implement gates to verify artifact signatures and attestations before deployment.
  • Use Case: Ensure compliance with security standards like SLSA by generating SBOMs and signing all build artifacts, providing auditable evidence of your software's integrity.

Quick Start

Use the sbom-supply-chain skill to generate an SBOM for the container image ghcr.io/acme/api:1.2.3.

Frequently Asked Questions about sbom-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for a container image?▼

To generate an SBOM for a container image, you need to analyze the build artifacts to produce a standardized list of components. This skill uses Syft to create SBOMs in SPDX or CycloneDX formats for container images like ghcr.io/acme/api:1.2.3.

What is a provenance attestation and how does it secure the software supply chain?▼

A provenance attestation secures the software supply chain by providing cryptographically signed metadata about how an artifact was built. This skill generates and signs attestations using Cosign to establish artifact trust and integrity.

How do I implement SLSA controls for build artifacts?▼

To implement SLSA controls for build artifacts, you must generate auditable evidence of your software's integrity. This skill helps you achieve SLSA compliance by creating SBOMs and signing provenance attestations for your releases.

Can I use Cosign to verify artifact signatures before deployment?▼

Yes, you can use Cosign to verify artifact signatures before deployment by implementing verification gates. This skill utilizes Cosign to sign build artifacts and verify those signatures, ensuring only trusted artifacts reach production.

Does this skill support vulnerability matching for application builds?▼

Yes, this skill supports vulnerability matching for application builds by utilizing Grype. It analyzes your SBOM data to identify and match known vulnerabilities in your software components.

Related Skills

Explore More Software Engineering Skills→
jrjsmrtnjrjsmrtn
12

setup-container-security

Harden container images with digest pinning, verified fetches, and grype/syft scanning.

Community
Advanced
a-ng-da-ng-d
1

glab-attestation

Validate GitLab attestations for artifact provenance and integrity.

Community
Intermediate
RedHatProductSecurityRedHatProductSecurity
47

semgrep

Automate static code analysis for security vulnerabilities across multi-language repositories.

Official
Intermediate
jeremylongshorejeremylongshore
2.6k

managing-container-registries

Create and configure container registries on AWS ECR, Google GCR, and Harbor.

Community
Advanced