<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-sbom-generation
description: >-
  Generate Software Bills of Materials using Syft, CycloneDX, and SPDX tooling.
  Integrate SBOM generation into CI/CD builds for supply chain transparency,
  vulnerability correlation, and regulatory compliance (EO 14028).
domain: cybersecurity
subdomain: devsecops
tags:
  - sbom
  - syft
  - cyclonedx
  - spdx
  - supply-chain
  - slsa
  - software-transparency
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Implementing SBOM Generation

## Overview

A Software Bill of Materials (SBOM) is a machine-readable inventory of all components,
libraries, and dependencies in software. Required by US Executive Order 14028, SBOMs
enable vulnerability correlation, license compliance, and supply chain risk management.
This skill covers generating, validating, and consuming SBOMs in CI/CD pipelines.

Mode: `[MODE: ARCHITECT]` — Supply chain transparency through SBOM automation.

## Prerequisites

| Requirement | Details |
|---|---|
| Syft (`brew install syft`) | Required |
| Grype for SBOM vulnerability scanning | Required |
| CycloneDX CLI or SPDX tools | Required |
| Cosign for SBOM attestation | Required |

## Key Concepts

### Syft SBOM Generation

```bash
# Generate from source directory
syft packages dir:. -o spdx-json > sbom.spdx.json
syft packages dir:. -o cyclonedx-json > sbom.cdx.json

# Generate from container image
syft packages docker:app:latest -o cyclonedx-json > sbom.cdx.json
syft packages ghcr.io/org/app:v1.2.3 -o spdx-json > sbom.spdx.json

# Generate from archive
syft packages file:app.tar -o cyclonedx-json > sbom.cdx.json

# Multiple output formats
syft packages dir:. -o spdx-json=sbom.spdx.json -o cyclonedx-json=sbom.cdx.json
```

### GitHub Actions Integration

```yaml
name: SBOM Generation
on:
  push:
    tags: ['v*']

jobs:
  sbom:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t app:${{ github.ref_name }} .

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: app:${{ github.ref_name }}
          format: cyclonedx-json
          output-file: sbom.cdx.json

      - name: Scan SBOM for vulnerabilities
        run: grype sbom:sbom.cdx.json --output json > sbom-vulns.json

      - name: Attest SBOM with Cosign
        run: |
          cosign attest --predicate sbom.cdx.json \
            --type cyclonedx \
            app:${{ github.ref_name }}

      - name: Upload SBOM as release asset
        uses: softprops/action-gh-release@v2
        with:
          files: |
            sbom.cdx.json
            sbom-vulns.json
```

### SBOM Validation

```bash
# Validate CycloneDX SBOM
cyclonedx validate --input-file sbom.cdx.json --input-format json

# Validate SPDX SBOM
java -jar spdx-tools.jar Verify sbom.spdx.json

# Check SBOM completeness with Syft
syft packages sbom:sbom.cdx.json -o table
```

### Vulnerability Correlation

```bash
# Scan SBOM with Grype
grype sbom:sbom.cdx.json --output json > vulns.json

# Scan SBOM with OSV-Scanner
osv-scanner --sbom=sbom.cdx.json --format json

# Scan SBOM with Trivy
trivy sbom sbom.cdx.json --severity HIGH,CRITICAL --format json
```

### SLSA Provenance

```yaml
# SLSA v1.0 provenance with GitHub Actions
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
  with:
    base64-subjects: "${{ needs.build.outputs.digest }}"

# Verify SLSA provenance
slsa-verifier verify-artifact app.tar.gz \
  --provenance-path provenance.intoto.jsonl \
  --source-uri github.com/org/repo \
  --source-tag v1.2.3
```

## Workflow

### Step 1: Generate SBOM

```bash
node scripts/agent.js --action generate --source . --format cyclonedx --output /tmp/sbom.json
```

### Step 2: Scan SBOM for Vulnerabilities

```bash
node scripts/agent.js --action scan --sbom /tmp/sbom.json --output /tmp/sbom-vulns.json
```

### Step 3: Validate SBOM

```bash
node scripts/agent.js --action validate --sbom /tmp/sbom.json --output /tmp/sbom-validation.json
```

## Detection

```yaml
title: Sbom Generation Detection
id: b84d4f0d-a351-42db-8d51-b489a0d251a3
status: experimental
description: Detects suspicious activity related to implementing sbom generation techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*sbom*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Sbom Generation Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] SBOM generated for every release build
- [ ] Both CycloneDX and SPDX formats supported
- [ ] SBOM includes all direct and transitive dependencies
- [ ] Vulnerability scan runs against SBOM after generation
- [ ] SBOM attached as release artifact
- [ ] SLSA provenance generated for build artifacts
- [ ] Cosign attestation applied to container images

## References

- [Syft Documentation](https://github.com/anchore/syft)
- [CycloneDX Specification](https://cyclonedx.org/specification/overview/)
- [SPDX Specification](https://spdx.github.io/spdx-spec/)
- [SLSA Framework](https://slsa.dev/)
- [NTIA SBOM Minimum Elements](https://www.ntia.gov/page/software-bill-materials)
