Supply chain and artifacts

Produces the inventory everything else consumes.

Start with

syft . -o spdx-json=sbom.json

The gotcha

An SBOM nobody can query is paperwork. Store and index them or do not bother.

Checks lockfiles and SBOMs against the OSV database, with low noise.

Start with

osv-scanner scan source -r .

The gotcha

Version 2 restructured the CLI, so anything you find using the old osv-scanner -r form is v1 syntax and will not run against a current binary. A tree with no manifest or lockfile exits 128 rather than 0, which reads like a crash in CI but only means there was nothing to scan.

Signs images and artifacts, and attaches provenance attestations.

Start with

cosign sign --key cosign.key myimage:tag

The gotcha

Signing without verification at admission proves nothing. The verifying policy is the control.

A registry you control, so dependency resolution has exactly one path in.

Start with

zot serve config.json

The gotcha

Retention defaults will either fill the disk or delete something you needed. Choose deliberately.

Answers where a vulnerable version is running, which is the question that matters in an incident.

Start with

docker compose up -d

The gotcha

Only useful if every build uploads. A partial inventory gives false confidence.