Establish End-to-End Supply Chain Integrity and Artifact Provenance

Duration: ~30 minutes

Overview

Design and implement comprehensive supply chain security frameworks that ensure end-to-end integrity of artifacts, provide complete provenance tracking, generate Software Bills of Materials (SBOMs), and enforce supply chain policies throughout the development and deployment lifecycle.

Establish end-to-end artifact provenance so builds, signatures, and deployments can be trusted from source to runtime.

Why it matters

Supply chain attacks are increasingly common and dangerous:

  • Artifact Integrity: Ensure artifacts haven’t been tampered with

  • Provenance Tracking: Know the origin and history of every artifact

  • SBOM Requirements: Meet regulatory requirements for software transparency

  • Policy Enforcement: Prevent unauthorized or untrusted artifacts

  • Vulnerability Management: Track vulnerabilities through supply chain

  • Compliance: Meet supply chain security standards (SLSA, NIST SSDF)

What does it solve

Supply chain security challenges include:

  • Artifacts lack cryptographic signatures

  • Provenance information is incomplete or missing

  • SBOMs are not generated or attested

  • Supply chain policies are not enforced automatically

  • Vulnerability tracking is fragmented

  • Compliance evidence is difficult to produce

This lab addresses these by:

  • Implementing comprehensive signing frameworks

  • Providing complete provenance tracking

  • Automating SBOM generation and attestation

  • Enforcing policies at multiple enforcement points

  • Integrating supply chain security throughout the lifecycle

  • Creating audit trails for compliance

Your Mission

Prove builds, signatures, and deployments form a chain an attacker cannot quietly splice. From source to runtime, unbroken provenance is the mission.

Understanding the Architecture

Component Purpose OpenShift/K8s Implementation

Artifact Signing

Cryptographic signatures for artifacts

Cosign, Sigstore, signing keys, signature verification

SBOM Generation

Software Bills of Materials

Syft, SPDX, CycloneDX, SBOM formats

Attestation

Proof of artifact properties

In-toto attestations, SLSA provenance, policy attestations

Supply Chain Assurance

Trust levels and policies

Assurance level definitions, policy frameworks

Policy Enforcement

Prevent untrusted artifacts

Admission controllers, image policies, signature verification

Provenance Tracking

Complete artifact history

Provenance metadata, attestation storage, tracking systems

Lab Content

This lab is currently under development. Content will include:

  • Artifact signing framework setup (Cosign/Sigstore)

  • SBOM generation and attestation workflows

  • Supply chain assurance level definitions

  • Policy enforcement at admission and runtime

  • Provenance tracking and verification

  • CI/CD pipeline integration

Prerequisites

  • OpenShift cluster with cluster-admin access

  • Access to container registries and artifact repositories

  • Understanding of supply chain security concepts

  • Familiarity with signing tools (Cosign, Sigstore)

  • Experience with SBOM generation tools

  • Knowledge of SLSA and supply chain frameworks

Debrief

Supply chain integrity is unbroken provenance from source to runtime: sign, attest, admit only what you can verify.

What this module targets:

  • Cosign/Sigstore and Trusted Artifact Signer patterns

  • SBOM and attestation

  • Admission enforcement of provenance

Until full exercises land: decide which registry paths must be signed tomorrow versus still tag-mutable today.

giphy

Cleanup

Before moving to the next module, run the lab cleanup script to reset transient resources from this module.

cd ~/openshift-security-roadshow
bash setup/lab-cleanup.sh --module 301-06