skills.rest
ivanuser
ivanuserCOMMUNITY
Explore all skills by this author →
GitHub

sbom-supply-chain-security

Generate CycloneDX or SPDX SBOMs and verify signatures in CI pipelines.

Updated Mar 20, 2026
Search Tags:#security#provenance#supply-chain#ci-cd#sbom#signature-verification
One-click install
npx skills add https://github.com/ivanuser/cortex-server-skills --skill sbom-supply-chain-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom-supply-chain-security
Source: https://github.com/ivanuser/cortex-server-skills/tree/main/security/sbom-supply-chain-security
Command: npx skills add https://github.com/ivanuser/cortex-server-skills --skill sbom-supply-chain-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Software supply chains are at risk from insecure dependencies, opaque provenance, and unverifiable artifact integrity. Generating SBOMs and verifying signatures helps you detect vulnerabilities and enforce trust across releases.

Core Features & Use Cases

  • Generate SBOMs (CycloneDX or SPDX) for release artifacts and container images.
  • Verify signatures and provenance to ensure components come from trusted sources.
  • Enforce policy gates in CI to prevent deployment of vulnerable or unverified components.

Quick Start

Run the SBOM workflow to generate a CycloneDX SBOM for your release and verify artifact provenance in CI.

Frequently Asked Questions about sbom-supply-chain-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for release artifacts in a CI pipeline?▼

You generate an SBOM for release artifacts by running a workflow that creates CycloneDX or SPDX documents and verifies artifact provenance. This enforces policy gates in CI pipelines to prevent deploying vulnerable components.

What is the best way to verify signatures and provenance for container images?▼

Verifying signatures and provenance for container images is done by applying policy gates in CI pipelines. This ensures components originate from trusted sources and reduces dependency-chain risk before release.

Can I use this to enforce policy gates for CycloneDX and SPDX formats?▼

Yes, you can enforce policy gates in CI pipelines for both CycloneDX and SPDX formats. This prevents the deployment of vulnerable or unverified components across package ecosystems and container images.

Why does software supply chain security require SBOM generation?▼

Software supply chain security requires SBOM generation to reduce dependency-chain risk from opaque provenance and insecure dependencies. Generating SBOMs detects vulnerabilities and enforces trust across releases.

Do I need specific dependencies to verify artifact integrity in automated workflows?▼

No specific dependencies are required to verify artifact integrity in automated workflows. The process operates independently to apply signature verification and enforce policy gating for container images and package ecosystems.

Related Skills

Explore More Software Engineering Skills→
riandeoliveirariandeoliveira

scanning-container-images-with-grype

Scans container images and SBOMs for known vulnerabilities using Grype.

Community
Intermediate
woohyun212woohyun212
21

supply-chain-audit

Audit software supply chains with SCA scans, SLSA matrices, and SBOMs.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

phase-2-automation-weeks-5-8

Automate CI/CD gate enforcement, SBOM generation, vulnerability scanning, and SLSA provenance.

Official
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced