[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PD2PR7B04MX6EW1TA0AZH8":3,"skill-same:01M6PD2PR7B04MX6EW1TA0AZH8":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":30,"commitSha":52,"skillDirectory":53,"forksCount":13,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6PD2PR7B04MX6EW1TA0AZH8","sbom-supply-chain",null,"Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fsbom-supply-chain\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"sbom supply chain","supply","SBOM","chain","supply chain","implementing","safe","relevant","scripts","scope","active","artifact","main","community","releases","only","devops-security","generate","assessment","secure","2026-11-10 10:12:30",false,"---\nname: sbom-supply-chain\ndescription: Generate, sign, and verify SBOMs and provenance attestations to secure\n  the software supply chain. Use when implementing SLSA controls, artifact trust policies,\n  or compliance evidence for releases.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# SBOM & Supply Chain Security\n\nImprove release trust with reproducible metadata and verification gates.\n\n## When to Use This Skill\n\nUse this skill when:\n- Producing SBOMs for container images or application builds\n- Verifying dependencies before deploy\n- Enforcing signed artifact and provenance policies\n- Preparing for SOC2, ISO 27001, or customer security reviews\n- Implementing SLSA framework requirements\n- Responding to supply chain vulnerabilities (e.g., Log4Shell-style events)\n\n## Prerequisites\n\n- `syft` installed for SBOM generation\n- `cdxgen` installed for CycloneDX SBOM generation\n- `grype` for vulnerability matching against SBOMs\n- `cosign` v2+ for signing and attestation\n- Container registry with OCI artifact support\n- CI\u002FCD pipeline with OIDC identity for keyless signing\n\n## SBOM Formats\n\n### CycloneDX vs SPDX Comparison\n\n```yaml\ncomparison:\n  cyclonedx:\n    standard: \"OWASP CycloneDX\"\n    focus: \"Application security, vulnerability tracking\"\n    formats: [\"JSON\", \"XML\", \"Protocol Buffers\"]\n    strengths:\n      - Vulnerability references (VEX support)\n      - Service and API dependency tracking\n      - Hardware BOM support\n    best_for: \"Security-focused SBOM, vulnerability management\"\n\n  spdx:\n    standard: \"Linux Foundation SPDX (ISO\u002FIEC 5962:2021)\"\n    focus: \"License compliance, legal review\"\n    formats: [\"JSON\", \"RDF\u002FXML\", \"Tag-Value\", \"YAML\"]\n    strengths:\n      - ISO standard\n      - License expression language\n      - Relationship modeling\n    best_for: \"License compliance, regulatory requirements\"\n```\n\n## Syft SBOM Generation\n\n```bash\n# Generate SBOM for a container image (CycloneDX JSON)\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o cyclonedx-json > sbom-cyclonedx.json\n\n# Generate SBOM in SPDX format\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o spdx-json > sbom-spdx.json\n\n# Generate SBOM from a local directory (source code)\nsyft dir:. -o cyclonedx-json > sbom-source.json\n\n# Generate SBOM from a Dockerfile\u002Fbuilt image\nsyft docker:my-local-image:latest -o cyclonedx-json > sbom-local.json\n\n# Generate SBOM for a specific package ecosystem\nsyft dir:. --catalogers python -o cyclonedx-json > sbom-python.json\n\n# Include file hashes for deeper analysis\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o cyclonedx-json --file-metadata > sbom-with-hashes.json\n\n# Multiple output formats simultaneously\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 \\\n  -o cyclonedx-json=sbom-cdx.json \\\n  -o spdx-json=sbom-spdx.json \\\n  -o table=sbom-summary.txt\n```\n\n## cdxgen SBOM Generation\n\n```bash\n# Install cdxgen\nnpm install -g @cyclonedx\u002Fcdxgen\n\n# Generate CycloneDX SBOM for a project directory\ncdxgen -o sbom.json .\n\n# Specify project type\ncdxgen -t python -o sbom-python.json .\ncdxgen -t java -o sbom-java.json .\ncdxgen -t node -o sbom-node.json .\ncdxgen -t go -o sbom-go.json .\n\n# Generate SBOM with evidence (call stacks, file occurrences)\ncdxgen --evidence -o sbom-with-evidence.json .\n\n# Generate for a container image\ncdxgen -t docker -o sbom-container.json ghcr.io\u002Facme\u002Fapi:v1.2.3\n\n# Generate with deep analysis (slower but more accurate)\ncdxgen --deep -o sbom-deep.json .\n\n# Output in different formats\ncdxgen -o sbom.xml --format xml .\n```\n\n## Vulnerability Matching\n\n```bash\n# Scan SBOM for vulnerabilities with Grype\ngrype sbom:sbom-cyclonedx.json\n\n# Fail on critical\u002Fhigh vulnerabilities\ngrype sbom:sbom-cyclonedx.json --fail-on high\n\n# Output as JSON for CI processing\ngrype sbom:sbom-cyclonedx.json -o json > vulnerability-report.json\n\n# Scan container image directly\ngrype ghcr.io\u002Facme\u002Fapi:v1.2.3\n\n# Use Trivy with SBOM input\ntrivy sbom sbom-cyclonedx.json\n\n# Trivy scan with severity filter\ntrivy sbom sbom-cyclonedx.json --severity CRITICAL,HIGH --exit-code 1\n```\n\n## Cosign Signing and Attestation\n\n### Image Signing\n\n```bash\n# Keyless signing (recommended - uses OIDC identity from CI)\ncosign sign ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Sign with a key pair\ncosign generate-key-pair\ncosign sign --key cosign.key ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity=https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain \\\n  --certificate-oidc-issuer=https:\u002F\u002Ftoken.actions.githubusercontent.com \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify with key\ncosign verify --key cosign.pub ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n```\n\n### SBOM Attestation\n\n```bash\n# Attach SBOM as an in-toto attestation to a container image\ncosign attest --predicate sbom-cyclonedx.json \\\n  --type cyclonedx \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Attach SPDX SBOM\ncosign attest --predicate sbom-spdx.json \\\n  --type spdx \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify SBOM attestation\ncosign verify-attestation \\\n  --type cyclonedx \\\n  --certificate-identity=https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain \\\n  --certificate-oidc-issuer=https:\u002F\u002Ftoken.actions.githubusercontent.com \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Extract the SBOM from attestation\ncosign verify-attestation --type cyclonedx \\\n  --certificate-identity=... --certificate-oidc-issuer=... \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123... | jq -r '.payload' | base64 -d | jq '.predicate' \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n```\n\n### In-toto Provenance Attestation\n\n```bash\n# Create a custom provenance attestation\ncat > provenance.json \u003C\u003C 'EOF'\n{\n  \"buildType\": \"https:\u002F\u002Fgithub.com\u002Facme\u002Fbuild-system@v1\",\n  \"builder\": {\n    \"id\": \"https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain\"\n  },\n  \"invocation\": {\n    \"configSource\": {\n      \"uri\": \"git+https:\u002F\u002Fgithub.com\u002Facme\u002Fapi@refs\u002Fheads\u002Fmain\",\n      \"digest\": { \"sha1\": \"abc123def456\" },\n      \"entryPoint\": \".github\u002Fworkflows\u002Fbuild.yml\"\n    }\n  },\n  \"metadata\": {\n    \"buildStartedOn\": \"2025-01-15T10:00:00Z\",\n    \"buildFinishedOn\": \"2025-01-15T10:05:00Z\",\n    \"completeness\": {\n      \"parameters\": true,\n      \"environment\": true,\n      \"materials\": true\n    }\n  },\n  \"materials\": [\n    {\n      \"uri\": \"git+https:\u002F\u002Fgithub.com\u002Facme\u002Fapi@refs\u002Fheads\u002Fmain\",\n      \"digest\": { \"sha1\": \"abc123def456\" }\n    },\n    {\n      \"uri\": \"pkg:docker\u002Fpython@3.11-slim\",\n      \"digest\": { \"sha256\": \"def456...\" }\n    }\n  ]\n}\nEOF\n\n# Attach provenance attestation\ncosign attest --predicate provenance.json \\\n  --type slsaprovenance \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n```\n\n## CI\u002FCD Pipeline Integration\n\n```yaml\n# .github\u002Fworkflows\u002Fsbom-supply-chain.yml\nname: Build with SBOM and Signing\non:\n  push:\n    tags: ['v*']\n\npermissions:\n  contents: read\n  packages: write\n  id-token: write  # Required for keyless signing\n\njobs:\n  build-sign-attest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Set up Docker Buildx\n        uses: docker\u002Fsetup-buildx-action@v3\n\n      - name: Login to GHCR\n        uses: docker\u002Flogin-action@v3\n        with:\n          registry: ghcr.io\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n\n      - name: Build and push image\n        id: build\n        uses: docker\u002Fbuild-push-action@v5\n        with:\n          push: true\n          tags: ghcr.io\u002F${{ github.repository }}:${{ github.ref_name }}\n\n      - name: Install tools\n        run: |\n          curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh -o \u002Ftmp\u002Finstall-syft.sh && sh \u002Ftmp\u002Finstall-syft.sh && rm \u002Ftmp\u002Finstall-syft.sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n          curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh -o \u002Ftmp\u002Finstall-grype.sh && sh \u002Ftmp\u002Finstall-grype.sh && rm \u002Ftmp\u002Finstall-grype.sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n      - name: Generate SBOM\n        run: |\n          syft ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }} \\\n            -o cyclonedx-json=sbom-cdx.json \\\n            -o spdx-json=sbom-spdx.json\n\n      - name: Scan SBOM for vulnerabilities\n        run: |\n          grype sbom:sbom-cdx.json --fail-on critical -o json > vuln-report.json\n\n      - name: Install cosign\n        uses: sigstore\u002Fcosign-installer@v3\n\n      - name: Sign image (keyless)\n        run: |\n          cosign sign ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }}\n\n      - name: Attach SBOM attestation\n        run: |\n          cosign attest --predicate sbom-cdx.json \\\n            --type cyclonedx \\\n            ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }}\n\n      - name: Upload artifacts\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom-and-reports\n          path: |\n            sbom-cdx.json\n            sbom-spdx.json\n            vuln-report.json\n```\n\n## Policy Enforcement\n\n### Kyverno Policy: Require Signed Images with SBOM\n\n```yaml\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-signed-images-with-sbom\nspec:\n  validationFailureAction: Enforce\n  webhookTimeoutSeconds: 30\n  rules:\n    - name: verify-signature\n      match:\n        any:\n          - resources:\n              kinds: [\"Pod\"]\n      verifyImages:\n        - imageReferences: [\"ghcr.io\u002Facme\u002F*\"]\n          attestors:\n            - entries:\n                - keyless:\n                    subject: \"https:\u002F\u002Fgithub.com\u002Facme\u002F*\"\n                    issuer: \"https:\u002F\u002Ftoken.actions.githubusercontent.com\"\n                    rekor:\n                      url: \"https:\u002F\u002Frekor.sigstore.dev\"\n          attestations:\n            - type: cyclonedx\n              conditions:\n                - all:\n                    - key: \"{{ components[].name }}\"\n                      operator: AllNotIn\n                      value: [\"log4j-core\"]\n```\n\n### OPA Policy: Verify SBOM Before Deploy\n\n```rego\npackage sbom.verify\n\nimport rego.v1\n\ndefault allow := false\n\nallow if {\n    sbom_present\n    no_critical_vulns\n    signed_by_ci\n}\n\nsbom_present if {\n    input.attestations.cyclonedx != null\n    count(input.attestations.cyclonedx.components) > 0\n}\n\nno_critical_vulns if {\n    not any_critical\n}\n\nany_critical if {\n    some vuln in input.vulnerability_report.matches\n    vuln.vulnerability.severity == \"Critical\"\n    vuln.vulnerability.fix.state == \"fixed\"\n}\n\nsigned_by_ci if {\n    input.signature.issuer == \"https:\u002F\u002Ftoken.actions.githubusercontent.com\"\n    startswith(input.signature.subject, \"https:\u002F\u002Fgithub.com\u002Facme\u002F\")\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| Syft misses dependencies | Unsupported package manager or format | Check syft catalogers list; use `cdxgen` for deeper analysis; contribute upstream |\n| Cosign sign fails with \"no identity token\" | Missing OIDC provider in CI | Ensure `id-token: write` permission in GitHub Actions; check OIDC provider config |\n| Grype reports false positives | Package version detection incorrect | Verify SBOM accuracy; report to grype GitHub; add ignore rules for confirmed FPs |\n| SBOM attestation too large | Large image with many dependencies | Compress SBOM; use SPDX compact format; consider splitting per layer |\n| Verification fails in admission controller | Wrong identity or issuer URL | Check exact `--certificate-identity` and `--certificate-oidc-issuer` values |\n| cdxgen produces empty SBOM | Project type not detected | Specify type explicitly with `-t`; ensure manifest files (package.json, etc.) exist |\n\n## Best Practices\n\n- Generate SBOMs in both CycloneDX and SPDX for maximum compatibility\n- Sign all release artifacts with keyless signing (Sigstore\u002FFulcio)\n- Attach SBOMs as in-toto attestations to container images\n- Scan SBOMs for vulnerabilities in CI and block on critical findings\n- Archive SBOMs for every release for audit and incident response\n- Enforce signature verification in admission controllers (Kyverno, OPA)\n- Monitor for new CVEs against stored SBOMs continuously\n- Include SBOM generation in every build pipeline, not just releases\n- Track SBOM completeness metrics (percentage of deps captured)\n- Establish a VEX (Vulnerability Exploitability eXchange) process for false positives\n\n## Related Skills\n\n- dependency-scanning (`dependency-scanning`) - Library vulnerability triage\n- container-scanning (`container-scanning`) - Container CVE scanning\n- policy-as-code (`policy-as-code`) - Policy enforcement\n- model-supply-chain-security (`model-supply-chain-security`) - ML artifact trust\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# SBOM & Supply Chain Security\n\nImprove release trust with reproducible metadata and verification gates.\n\n## When to Use This Skill\n\nUse this skill when:\n- Producing SBOMs for container images or application builds\n- Verifying dependencies before deploy\n- Enforcing signed artifact and provenance policies\n- Preparing for SOC2, ISO 27001, or customer security reviews\n- Implementing SLSA framework requirements\n- Responding to supply chain vulnerabilities (e.g., Log4Shell-style events)\n\n## Prerequisites\n\n- `syft` installed for SBOM generation\n- `cdxgen` installed for CycloneDX SBOM generation\n- `grype` for vulnerability matching against SBOMs\n- `cosign` v2+ for signing and attestation\n- Container registry with OCI artifact support\n- CI\u002FCD pipeline with OIDC identity for keyless signing\n\n## SBOM Formats\n\n### CycloneDX vs SPDX Comparison\n\n```yaml\ncomparison:\n  cyclonedx:\n    standard: \"OWASP CycloneDX\"\n    focus: \"Application security, vulnerability tracking\"\n    formats: [\"JSON\", \"XML\", \"Protocol Buffers\"]\n    strengths:\n      - Vulnerability references (VEX support)\n      - Service and API dependency tracking\n      - Hardware BOM support\n    best_for: \"Security-focused SBOM, vulnerability management\"\n\n  spdx:\n    standard: \"Linux Foundation SPDX (ISO\u002FIEC 5962:2021)\"\n    focus: \"License compliance, legal review\"\n    formats: [\"JSON\", \"RDF\u002FXML\", \"Tag-Value\", \"YAML\"]\n    strengths:\n      - ISO standard\n      - License expression language\n      - Relationship modeling\n    best_for: \"License compliance, regulatory requirements\"\n```\n\n## Syft SBOM Generation\n\n```bash\n# Generate SBOM for a container image (CycloneDX JSON)\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o cyclonedx-json > sbom-cyclonedx.json\n\n# Generate SBOM in SPDX format\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o spdx-json > sbom-spdx.json\n\n# Generate SBOM from a local directory (source code)\nsyft dir:. -o cyclonedx-json > sbom-source.json\n\n# Generate SBOM from a Dockerfile\u002Fbuilt image\nsyft docker:my-local-image:latest -o cyclonedx-json > sbom-local.json\n\n# Generate SBOM for a specific package ecosystem\nsyft dir:. --catalogers python -o cyclonedx-json > sbom-python.json\n\n# Include file hashes for deeper analysis\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 -o cyclonedx-json --file-metadata > sbom-with-hashes.json\n\n# Multiple output formats simultaneously\nsyft ghcr.io\u002Facme\u002Fapi:v1.2.3 \\\n  -o cyclonedx-json=sbom-cdx.json \\\n  -o spdx-json=sbom-spdx.json \\\n  -o table=sbom-summary.txt\n```\n\n## cdxgen SBOM Generation\n\n```bash\n# Install cdxgen\nnpm install -g @cyclonedx\u002Fcdxgen\n\n# Generate CycloneDX SBOM for a project directory\ncdxgen -o sbom.json .\n\n# Specify project type\ncdxgen -t python -o sbom-python.json .\ncdxgen -t java -o sbom-java.json .\ncdxgen -t node -o sbom-node.json .\ncdxgen -t go -o sbom-go.json .\n\n# Generate SBOM with evidence (call stacks, file occurrences)\ncdxgen --evidence -o sbom-with-evidence.json .\n\n# Generate for a container image\ncdxgen -t docker -o sbom-container.json ghcr.io\u002Facme\u002Fapi:v1.2.3\n\n# Generate with deep analysis (slower but more accurate)\ncdxgen --deep -o sbom-deep.json .\n\n# Output in different formats\ncdxgen -o sbom.xml --format xml .\n```\n\n## Vulnerability Matching\n\n```bash\n# Scan SBOM for vulnerabilities with Grype\ngrype sbom:sbom-cyclonedx.json\n\n# Fail on critical\u002Fhigh vulnerabilities\ngrype sbom:sbom-cyclonedx.json --fail-on high\n\n# Output as JSON for CI processing\ngrype sbom:sbom-cyclonedx.json -o json > vulnerability-report.json\n\n# Scan container image directly\ngrype ghcr.io\u002Facme\u002Fapi:v1.2.3\n\n# Use Trivy with SBOM input\ntrivy sbom sbom-cyclonedx.json\n\n# Trivy scan with severity filter\ntrivy sbom sbom-cyclonedx.json --severity CRITICAL,HIGH --exit-code 1\n```\n\n## Cosign Signing and Attestation\n\n### Image Signing\n\n```bash\n# Keyless signing (recommended - uses OIDC identity from CI)\ncosign sign ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Sign with a key pair\ncosign generate-key-pair\ncosign sign --key cosign.key ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify keyless signature\ncosign verify \\\n  --certificate-identity=https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain \\\n  --certificate-oidc-issuer=https:\u002F\u002Ftoken.actions.githubusercontent.com \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify with key\ncosign verify --key cosign.pub ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n```\n\n### SBOM Attestation\n\n```bash\n# Attach SBOM as an in-toto attestation to a container image\ncosign attest --predicate sbom-cyclonedx.json \\\n  --type cyclonedx \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Attach SPDX SBOM\ncosign attest --predicate sbom-spdx.json \\\n  --type spdx \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Verify SBOM attestation\ncosign verify-attestation \\\n  --type cyclonedx \\\n  --certificate-identity=https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain \\\n  --certificate-oidc-issuer=https:\u002F\u002Ftoken.actions.githubusercontent.com \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n\n# Extract the SBOM from attestation\ncosign verify-attestation --type cyclonedx \\\n  --certificate-identity=... --certificate-oidc-issuer=... \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123... | jq -r '.payload' | base64 -d | jq '.predicate' \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n```\n\n### In-toto Provenance Attestation\n\n```bash\n# Create a custom provenance attestation\ncat > provenance.json \u003C\u003C 'EOF'\n{\n  \"buildType\": \"https:\u002F\u002Fgithub.com\u002Facme\u002Fbuild-system@v1\",\n  \"builder\": {\n    \"id\": \"https:\u002F\u002Fgithub.com\u002Facme\u002Fapi\u002F.github\u002Fworkflows\u002Fbuild.yml@refs\u002Fheads\u002Fmain\"\n  },\n  \"invocation\": {\n    \"configSource\": {\n      \"uri\": \"git+https:\u002F\u002Fgithub.com\u002Facme\u002Fapi@refs\u002Fheads\u002Fmain\",\n      \"digest\": { \"sha1\": \"abc123def456\" },\n      \"entryPoint\": \".github\u002Fworkflows\u002Fbuild.yml\"\n    }\n  },\n  \"metadata\": {\n    \"buildStartedOn\": \"2025-01-15T10:00:00Z\",\n    \"buildFinishedOn\": \"2025-01-15T10:05:00Z\",\n    \"completeness\": {\n      \"parameters\": true,\n      \"environment\": true,\n      \"materials\": true\n    }\n  },\n  \"materials\": [\n    {\n      \"uri\": \"git+https:\u002F\u002Fgithub.com\u002Facme\u002Fapi@refs\u002Fheads\u002Fmain\",\n      \"digest\": { \"sha1\": \"abc123def456\" }\n    },\n    {\n      \"uri\": \"pkg:docker\u002Fpython@3.11-slim\",\n      \"digest\": { \"sha256\": \"def456...\" }\n    }\n  ]\n}\nEOF\n\n# Attach provenance attestation\ncosign attest --predicate provenance.json \\\n  --type slsaprovenance \\\n  ghcr.io\u002Facme\u002Fapi@sha256:abc123...\n```\n\n## CI\u002FCD Pipeline Integration\n\n```yaml\n# .github\u002Fworkflows\u002Fsbom-supply-chain.yml\nname: Build with SBOM and Signing\non:\n  push:\n    tags: ['v*']\n\npermissions:\n  contents: read\n  packages: write\n  id-token: write  # Required for keyless signing\n\njobs:\n  build-sign-attest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Set up Docker Buildx\n        uses: docker\u002Fsetup-buildx-action@v3\n\n      - name: Login to GHCR\n        uses: docker\u002Flogin-action@v3\n        with:\n          registry: ghcr.io\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n\n      - name: Build and push image\n        id: build\n        uses: docker\u002Fbuild-push-action@v5\n        with:\n          push: true\n          tags: ghcr.io\u002F${{ github.repository }}:${{ github.ref_name }}\n\n      - name: Install tools\n        run: |\n          curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh -o \u002Ftmp\u002Finstall-syft.sh && sh \u002Ftmp\u002Finstall-syft.sh && rm \u002Ftmp\u002Finstall-syft.sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n          curl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fgrype\u002Fmain\u002Finstall.sh -o \u002Ftmp\u002Finstall-grype.sh && sh \u002Ftmp\u002Finstall-grype.sh && rm \u002Ftmp\u002Finstall-grype.sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n      - name: Generate SBOM\n        run: |\n          syft ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }} \\\n            -o cyclonedx-json=sbom-cdx.json \\\n            -o spdx-json=sbom-spdx.json\n\n      - name: Scan SBOM for vulnerabilities\n        run: |\n          grype sbom:sbom-cdx.json --fail-on critical -o json > vuln-report.json\n\n      - name: Install cosign\n        uses: sigstore\u002Fcosign-installer@v3\n\n      - name: Sign image (keyless)\n        run: |\n          cosign sign ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }}\n\n      - name: Attach SBOM attestation\n        run: |\n          cosign attest --predicate sbom-cdx.json \\\n            --type cyclonedx \\\n            ghcr.io\u002F${{ github.repository }}@${{ steps.build.outputs.digest }}\n\n      - name: Upload artifacts\n        uses: actions\u002Fupload-artifact@v4\n        with:\n          name: sbom-and-reports\n          path: |\n            sbom-cdx.json\n            sbom-spdx.json\n            vuln-report.json\n```\n\n## Policy Enforcement\n\n### Kyverno Policy: Require Signed Images with SBOM\n\n```yaml\napiVersion: kyverno.io\u002Fv1\nkind: ClusterPolicy\nmetadata:\n  name: require-signed-images-with-sbom\nspec:\n  validationFailureAction: Enforce\n  webhookTimeoutSeconds: 30\n  rules:\n    - name: verify-signature\n      match:\n        any:\n          - resources:\n              kinds: [\"Pod\"]\n      verifyImages:\n        - imageReferences: [\"ghcr.io\u002Facme\u002F*\"]\n          attestors:\n            - entries:\n                - keyless:\n                    subject: \"https:\u002F\u002Fgithub.com\u002Facme\u002F*\"\n                    issuer: \"https:\u002F\u002Ftoken.actions.githubusercontent.com\"\n                    rekor:\n                      url: \"https:\u002F\u002Frekor.sigstore.dev\"\n          attestations:\n            - type: cyclonedx\n              conditions:\n                - all:\n                    - key: \"{{ components[].name }}\"\n                      operator: AllNotIn\n                      value: [\"log4j-core\"]\n```\n\n### OPA Policy: Verify SBOM Before Deploy\n\n```rego\npackage sbom.verify\n\nimport rego.v1\n\ndefault allow := false\n\nallow if {\n    sbom_present\n    no_critical_vulns\n    signed_by_ci\n}\n\nsbom_present if {\n    input.attestations.cyclonedx != null\n    count(input.attestations.cyclonedx.components) > 0\n}\n\nno_critical_vulns if {\n    not any_critical\n}\n\nany_critical if {\n    some vuln in input.vulnerability_report.matches\n    vuln.vulnerability.severity == \"Critical\"\n    vuln.vulnerability.fix.state == \"fixed\"\n}\n\nsigned_by_ci if {\n    input.signature.issuer == \"https:\u002F\u002Ftoken.actions.githubusercontent.com\"\n    startswith(input.signature.subject, \"https:\u002F\u002Fgithub.com\u002Facme\u002F\")\n}\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| Syft misses dependencies | Unsupported package manager or format | Check syft catalogers list; use `cdxgen` for deeper analysis; contribute upstream |\n| Cosign sign fails with \"no identity token\" | Missing OIDC provider in CI | Ensure `id-token: write` permission in GitHub Actions; check OIDC provider config |\n| Grype reports false positives | Package version detection incorrect | Verify SBOM accuracy; report to grype GitHub; add ignore rules for confirmed FPs |\n| SBOM attestation too large | Large image with many dependencies | Compress SBOM; use SPDX compact format; consider splitting per layer |\n| Verification fails in admission controller | Wrong identity or issuer URL | Check exact `--certificate-identity` and `--certificate-oidc-issuer` values |\n| cdxgen produces empty SBOM | Project type not detected | Specify type explicitly with `-t`; ensure manifest files (package.json, etc.) exist |\n\n## Best Practices\n\n- Generate SBOMs in both CycloneDX and SPDX for maximum compatibility\n- Sign all release artifacts with keyless signing (Sigstore\u002FFulcio)\n- Attach SBOMs as in-toto attestations to container images\n- Scan SBOMs for vulnerabilities in CI and block on critical findings\n- Archive SBOMs for every release for audit and incident response\n- Enforce signature verification in admission controllers (Kyverno, OPA)\n- Monitor for new CVEs against stored SBOMs continuously\n- Include SBOM generation in every build pipeline, not just releases\n- Track SBOM completeness metrics (percentage of deps captured)\n- Establish a VEX (Vulnerability Exploitability eXchange) process for false positives\n\n## Related Skills\n\n- dependency-scanning (`dependency-scanning`) - Library vulnerability triage\n- container-scanning (`container-scanning`) - Container CVE scanning\n- policy-as-code (`policy-as-code`) - Policy enforcement\n- model-supply-chain-security (`model-supply-chain-security`) - ML artifact trust\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":24,"source":43,"license":14,"category":44,"metadata":45,"date_added":48,"description":7,"source_repo":49,"source_type":31,"compatibility":50,"license_source":51},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":46,"version":47},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fsbom-supply-chain","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill sbom-supply-chain",{"tool":63,"command":64},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill sbom-supply-chain",{"tool":66,"command":67},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill sbom-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fsbom-supply-chain\u002FSKILL.md",true,[],[72,93,117,141,169,193],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[84,85,86,87,36,88,74,89,34,90,91,33,31,30,28,92,27,26,25,23],"ZeRO","trust","zero trust","architecture","verification","segmentation","access","configure","critical",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[100,101,102,103,104,105,106,107,108,109,110,111,112,33,113,31,114,115,92,116],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[124,125,126,24,127,128,129,130,131,132,133,134,135,31,30,136,137,138,139,140],"transcript","youtube transcript","youtube","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":158,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[147,150,153],{"categoryNo":148,"categoryName":149,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":151,"categoryName":152,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":154,"categoryName":155,"taxonomyType":156,"taxonomyTypeDesc":157},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[124,125,126,159,24,160,127,128,130,161,162,163,164,133,165,31,30,166,167,168],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":151,"categoryName":152,"taxonomyType":81,"taxonomyTypeDesc":82},[126,180,181,104,24,182,183,184,185,130,163,186,187,188,189,30,190,136,191,192],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[199],{"categoryNo":148,"categoryName":149,"taxonomyType":81,"taxonomyTypeDesc":82},[201,126,202,203,24,160,161,204,205,162,163,164,133,206,165,31,30,166,207,139],"youtube full","full","google","server","dlp","credits","automatic"]