moai-ref-supply-chain

Generate an SBOM at build time using syft, which emits both SPDX and CycloneDX formats from an artifact or source tree. Include the NTIA minimum elements such as supplier, component name, version, and dependency relationships, and attach it as a signed attestation.

SPDX is stewarded by the Linux Foundation and is license-centric with broad regulatory acceptance, while CycloneDX is an OWASP project focused on security with native vulnerability and dependency-relationship modeling. Both are interoperable, so choose based on ecosystem fit and consumer needs.

Prevent dependency confusion by reserving your organization's namespace on public registries, configuring resolvers to fetch internal names only from the internal registry, and pinning every dependency by content hash in the lockfile. Hash-pinning ensures a same-name substitution with different bytes fails verification.

Production environments typically require SLSA Build L2 or higher, meaning signed provenance from a hosted build platform. High-assurance environments should require L3, where the build runs in an isolated, ephemeral environment with non-forgeable provenance.

Cosign verifies an artifact's signature and checks the signer identity against an expected identity policy using keyless signing with short-lived OIDC-bound certificates. Verification should happen at install or admission time, and unsigned or wrong-identity artifacts are rejected.

Version pinning without hash pinning still accepts substituted bytes published under the same version string. Pinning by content hash in the lockfile ensures a same-version substitution fails the integrity check on install.