<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-supply-chain-security-architecture
description: >-
  Architect software supply chain security with SBOM generation, dependency verification,
  build provenance attestation, artifact signing, and pipeline integrity controls
  following SLSA framework principles.
domain: cybersecurity
subdomain: security-architecture
tags:
  - supply-chain
  - sbom
  - slsa
  - sigstore
  - dependency-management
  - build-provenance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195"]
---

# Performing Supply Chain Security Architecture

## Overview

Software supply chain security architecture protects the integrity of code, dependencies,
build processes, and deployment artifacts. This skill covers SBOM generation, dependency
vulnerability management, build provenance with SLSA levels, artifact signing with
Sigstore/cosign, and pipeline security hardening.

Mode: `[MODE: ARCHITECT]` — Supply chain integrity and provenance design.

## Prerequisites

- Source code repository with CI/CD pipeline
- Container registry with signing support
- SBOM tooling (syft, trivy, cyclonedx-cli)
- Python 3.10+
- Optional: cosign, rekor (Sigstore), in-toto

## Key Concepts

### SLSA Framework Levels

| Level | Requirements | Trust |
|-------|-------------|-------|
| **SLSA 0** | No guarantees | No provenance |
| **SLSA 1** | Build process documented | Provenance exists |
| **SLSA 2** | Hosted build, signed provenance | Tamper-resistant |
| **SLSA 3** | Hardened build, non-falsifiable provenance | Verified source |
| **SLSA 4** | Two-party review, hermetic builds | Full trust |

### Supply Chain Security Architecture

```
┌─────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐
│ Source   │──▶│ Build    │──▶│ Sign     │──▶│ Publish  │──▶│ Deploy   │
│          │   │          │   │          │   │          │   │          │
│ • Signed │   │ • Hermetic│  │ • Cosign │   │ • SBOM   │   │ • Verify │
│   commits│   │ • Logged │   │ • In-toto│   │ • Attested│  │   sigs   │
│ • CODEOWNERS│ • Repro- │   │ • Rekor  │   │ • Scanned│   │ • Admit  │
│ • Branch │   │   ducible│   │   log    │   │          │   │   policy │
│   protect│   │          │   │          │   │          │   │          │
└─────────┘   └──────────┘   └──────────┘   └──────────┘   └──────────┘
```

### SBOM Generation and Verification

```bash
# Generate SBOM with Syft
syft packages ./app -o cyclonedx-json > sbom.json

# Scan SBOM for vulnerabilities
grype sbom:sbom.json --output json > vulns.json

# Sign SBOM with cosign
cosign attest --predicate sbom.json --type cyclonedx \
  --key cosign.key registry.example.com/app:v1.2

# Verify attestation
cosign verify-attestation --type cyclonedx \
  --key cosign.pub registry.example.com/app:v1.2
```

### Build Provenance Attestation

```json
{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "registry.example.com/app",
      "digest": {"sha256": "abc123def456..."}
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://github.com/actions/runner",
      "resolvedDependencies": [
        {"uri": "git+https://github.com/org/repo@refs/heads/main",
         "digest": {"sha1": "abc123"}}
      ]
    },
    "runDetails": {
      "builder": {"id": "https://github.com/actions/runner/v2"},
      "metadata": {
        "invocationId": "https://github.com/org/repo/actions/runs/12345",
        "startedOn": "2026-01-15T10:00:00Z"
      }
    }
  }
}
```

### Dependency Policy

```json
{
  "dependency_policy": {
    "allowed_registries": ["registry.example.com", "ghcr.io"],
    "blocked_licenses": ["AGPL-3.0", "GPL-3.0"],
    "max_critical_vulns": 0,
    "max_high_vulns": 3,
    "require_pinned_versions": true,
    "require_lockfile": true,
    "max_dependency_age_days": 365,
    "allowed_ecosystems": ["npm", "pypi", "go", "cargo"]
  }
}
```

## Workflow

### Step 1: Generate SBOM

```bash
node scripts/agent.js --action sbom --manifest package.json --output sbom.json
```

### Step 2: Assess Dependencies

```bash
node scripts/agent.js --action assess --sbom sbom.json --policy policy.json
```

### Step 3: Evaluate SLSA Level

```bash
node scripts/agent.js --action slsa --pipeline pipeline.json --output slsa-report.json
```

### Step 4: Validate Supply Chain

```bash
node scripts/agent.js --action validate --sbom sbom.json --provenance provenance.json
```

## Detection

```yaml
title: Supply Chain Security Architecture Detection
id: 12eea939-7108-4309-955c-284c02f3dc68
status: experimental
description: Detects suspicious activity related to performing supply chain security architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1195
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```

## Verification

- [ ] SBOM generated for every release artifact
- [ ] All dependencies scanned for known vulnerabilities
- [ ] Build provenance attestation signed and published
- [ ] Container images signed with cosign before deployment
- [ ] Admission controller verifies signatures at deploy time
- [ ] Dependency policy enforces pinned versions and lockfiles
- [ ] Build environment hermetic — no network access during build
- [ ] Two-party review required for build config changes

## References

- [SLSA Framework](https://slsa.dev/)
- [NIST SP 800-218 SSDF](https://csrc.nist.gov/publications/detail/sp/800-218/final)
- [Sigstore Documentation](https://docs.sigstore.dev/)
- [CycloneDX SBOM Standard](https://cyclonedx.org/)
