Tag
11 items tagged SBOM.
Turn the SBOM from part 2 into a Cosign attestation bound to the image digest, verify it and read the predicate back, list what hangs off an image with cosign tree, and see what SLSA build provenance adds.
Run Syft from its container against a small Node.js image, read the CycloneDX output package by package, see where each one came from, learn what an SBOM does not prove, and store it next to the artifact.
Grype against the SBOM from part 2: 183 matches read by severity, ecosystem and fix state; two Dockerfile changes that take it to 3; exit-code behaviour for CI; and how to triage what remains.
The delivery chain from source through dependencies, build, artifact, image, registry and deployment; where each link can be compromised; and the control for each, from lockfiles and SBOMs to signing by digest.
How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Signs and verifies container images, SBOMs and attestations.
Vulnerability scanner for images, filesystems and SBOMs produced by Syft.
Generates SBOMs (CycloneDX, SPDX) from images, directories and archives.
All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.