<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-software-composition-governance
description: >-
  Implement governance policies for open-source and third-party software
  composition. Enforce license compliance, version pinning, approved-supplier
  lists, and automated policy gates in CI/CD pipelines.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - software-composition
  - governance
  - license-compliance
  - policy-enforcement
  - approved-suppliers
  - dependency-policy
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Implementing Software Composition Governance

## Overview

Software composition governance ensures that all third-party and open-source
components entering your software supply chain meet organizational security, legal,
and quality standards. This skill covers policy definition, automated enforcement
through CI/CD gates, license compliance scanning, and approved-supplier management.

Mode: `[MODE: ARCHITECT]` — Design and enforce software composition governance policies.

## Prerequisites

| Requirement | Details |
|---|---|
| FOSSA CLI or Snyk for license scanning | Required |
| OPA (Open Policy Agent) for policy enforcement | Required |
| Syft for SBOM generation | Required |
| jq for JSON processing | Required |
| Python 3.10+ with `license-expression`, `requests` | Required |

## Key Concepts

### License Compliance Scanning

```bash
# Scan project for license compliance
fossa analyze --output
fossa test --json | jq '.issues[] | {type, rule, license, dependency}'

# Extract license info from SBOM
jq '.components[] | {name, version, licenses: [.licenses[]?.license?.id // .licenses[]?.expression]}' sbom.cdx.json

# Detect copyleft licenses in production dependencies
jq '.components[] | select(.licenses[]?.license?.id |
  test("GPL|AGPL|LGPL|SSPL|EUPL")) | {name, license: .licenses[0].license.id}' sbom.cdx.json
```

### Version Pinning Enforcement

```bash
# Check npm for unpinned dependencies
jq '.dependencies | to_entries[] | select(.value | test("^[~^]")) |
  {name: .key, version: .value, issue: "not pinned"}' package.json

# Verify Python requirements are pinned
grep -E '^[a-zA-Z].*[^=]==[^=]' requirements.txt | wc -l
grep -vE '(^#|^$|==)' requirements.txt

# Verify Go modules use exact versions
go list -m all | grep -v '@v[0-9]'
```

### OPA Policy Gates

```bash
# Define composition policy
cat > policy.rego << 'EOF'
package composition

deny[msg] {
  input.license == "GPL-3.0"
  msg := sprintf("GPL-3.0 license not allowed: %s", [input.name])
}

deny[msg] {
  input.age_days > 365
  not input.maintained
  msg := sprintf("Unmaintained dependency: %s (last update %d days ago)", [input.name, input.age_days])
}
EOF

# Evaluate against policy
opa eval -i component.json -d policy.rego "data.composition.deny"
```

## Workflow

### Step 1: Scan project for governance policy violations

```bash
node scripts/agent.js --action scan --manifest /tmp/target --output /tmp/scan-result.json
```

### Step 2: Enforce composition policies against manifest

```bash
node scripts/agent.js --action enforce --manifest /tmp/target --output /tmp/enforce-result.json
```

### Step 3: Generate governance compliance report

```bash
node scripts/agent.js --action report --manifest /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Software Composition Governance Detection
id: 638913fb-096f-4d0c-bda9-17249c25831c
status: experimental
description: Detects suspicious activity related to implementing software composition governance techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*software*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Software Composition Governance Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All dependencies use approved licenses (no copyleft in proprietary builds)
- [ ] All production dependencies are version-pinned
- [ ] No dependencies from unapproved suppliers or registries
- [ ] Policy gates configured and enforced in CI/CD pipeline
- [ ] Governance audit trail maintained for compliance evidence

## References

- [FOSSA Documentation](https://docs.fossa.com/)
- [OPA Policy Language](https://www.openpolicyagent.org/docs/latest/policy-language/)
- [SPDX License List](https://spdx.org/licenses/)
- [OpenChain ISO 5230](https://www.openchainproject.org/)
