<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Supply Chain Container Attacks — API Reference

## Cosign Provenance Verification

```bash
cosign verify IMAGE
cosign verify --certificate-identity ID --certificate-oidc-issuer ISSUER IMAGE
cosign verify-attestation --type slsaprovenance --key KEY IMAGE
```

## SLSA Verifier

```bash
slsa-verifier verify-image IMAGE --source-uri SOURCE
slsa-verifier verify-artifact ARTIFACT --provenance-path PROV --source-uri SOURCE
```

## Syft SBOM Commands

```bash
syft IMAGE -o spdx-json > sbom.json
syft IMAGE -o cyclonedx-json > bom.json
syft IMAGE -o table
```

## Docker Layer Inspection

```bash
docker history --no-trunc IMAGE
docker save IMAGE | tar -xf - -C /tmp/layers/
docker inspect IMAGE | jq '.[0].RootFS.Layers'
```

## Trivy Supply Chain Scanning

```bash
trivy image --scanners vuln,secret,config IMAGE
trivy sbom sbom.json
trivy config Dockerfile
```

## Key SBOM Fields (SPDX)

| Field | Description |
|-------|-------------|
| `packages[].name` | Package name |
| `packages[].versionInfo` | Package version |
| `packages[].supplier` | Package supplier |
| `packages[].downloadLocation` | Source URL |
| `packages[].checksums` | Integrity hashes |
