Generating and Analyzing SBOMs

Authorized Use Only: Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.

Overview

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:

• CycloneDX — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).
• SPDX — a Linux Foundation / ISO standard (ISO/IEC 5962) strong on licensing and provenance.

The reference open-source toolchain is from Anchore:

• Syft generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.
• Grype matches an SBOM (or image) against vulnerability databases to find CVEs.
• Cosign (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.

This skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI/CD.

When to Use

• Establishing and maintaining a component inventory for applications and container images.
• Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).
• Satisfying procurement/regulatory SBOM requirements (CISA, EO 14028).
• Producing signed SBOM attestations for downstream supply-chain trust.

Prerequisites

• Install Syft and Grype (official install scripts):

  curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
  curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
  

• Install Cosign for signing/attestation:

  # via Go, or download a release from https://github.com/sigstore/cosign/releases
  go install github.com/sigstore/cosign/v2/cmd/cosign@latest
  

• Access to the target images/source and (for signing) a registry plus keys or keyless OIDC.

Objectives

• Generate CycloneDX and SPDX SBOMs from images and directories.
• Scan SBOMs and images for vulnerabilities with Grype.
• Gate CI/CD builds on severity thresholds.
• Sign and attach SBOM attestations with Cosign and verify them.

MITRE ATT&CK Mapping

ID	Official Technique Name	Relevance to this skill
T1195.001	Supply Chain Compromise: Compromise Software Dependencies and Development Tools	SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique.

This is a defensive supply-chain skill; the mapping reflects the adversary technique it is designed to detect and mitigate.

Workflow

1. Generate a CycloneDX SBOM from a container image

-o <format> selects output; cyclonedx-json is security-oriented.

syft alpine:latest -o cyclonedx-json=alpine.cdx.json

2. Generate an SPDX SBOM from a source directory

Use the dir: source to inventory a checked-out repository; spdx-json for the SPDX standard.

syft dir:. -o spdx-json=app.spdx.json

3. Emit multiple formats at once

Produce both standards in a single pass for different consumers.

syft myorg/app:1.4.2 \
  -o cyclonedx-json=app.cdx.json \
  -o spdx-json=app.spdx.json \
  -o table

4. Scan the SBOM for vulnerabilities with Grype

Decoupling generation from scanning lets you re-scan stored SBOMs as new CVEs land — without rebuilding.

# Scan an existing SBOM
grype sbom:app.cdx.json -o table

# JSON report for automation
grype sbom:app.cdx.json -o json > app.vulns.json

You can also scan an image directly (Grype generates the SBOM internally):

grype myorg/app:1.4.2 -o table

5. Gate CI/CD on severity

--fail-on exits non-zero at or above a severity, failing the pipeline.

grype sbom:app.cdx.json --fail-on high

Filter out unfixable noise with a .grype.yaml policy (only-fixed: true) or --only-fixed:

grype sbom:app.cdx.json --only-fixed --fail-on critical

6. Sign and attach the SBOM as an attestation

Cosign records the SBOM as a signed, in-toto attestation alongside the image in the registry.

# Key-based signing
cosign attest --key cosign.key \
  --predicate app.spdx.json \
  --type spdxjson \
  myorg/app:1.4.2

# Keyless (Sigstore OIDC / Fulcio + Rekor)
COSIGN_EXPERIMENTAL=1 cosign attest \
  --predicate app.cdx.json \
  --type cyclonedx \
  myorg/app:1.4.2

7. Verify the attestation downstream

Consumers verify provenance before trusting an image.

cosign verify-attestation --key cosign.pub --type spdxjson myorg/app:1.4.2

8. Retrieve and re-scan attached SBOMs

Pull the attested SBOM from the registry and re-run Grype as part of continuous monitoring.

cosign download attestation myorg/app:1.4.2 \
  | jq -r '.payload' | base64 -d | jq '.predicate' > pulled.spdx.json
grype sbom:pulled.spdx.json -o table

9. Correlate to vulnerability intelligence

Feed Grype JSON into your vulnerability management workflow: deduplicate by CVE, enrich with EPSS/KEV for prioritization, and track remediation SLAs. Re-scan stored SBOMs on each Grype DB update to catch newly disclosed CVEs in unchanged artifacts.

Tools and Resources

Tool	Purpose	Link
Syft	SBOM generation	https://github.com/anchore/syft
Grype	Vulnerability scanning of SBOMs/images	https://github.com/anchore/grype
Cosign	SBOM signing/attestation	https://github.com/sigstore/cosign
CycloneDX	Security-focused SBOM standard	https://cyclonedx.org/
SPDX	ISO SBOM standard	https://spdx.dev/
CISA SBOM	Guidance and minimum elements	https://www.cisa.gov/sbom

Format Comparison

Aspect	CycloneDX	SPDX
Steward	OWASP	Linux Foundation / ISO 5962
Strength	Security, VEX, vulnerabilities	Licensing, provenance
Common syft -o values	cyclonedx-json, cyclonedx-xml	spdx-json, spdx (tag-value)

Validation Criteria

• CycloneDX SBOM generated from the target image
• SPDX SBOM generated from source where required
• SBOM scanned with Grype producing a CVE report
• CI/CD gated with --fail-on at an agreed severity
• SBOM signed and attached as an attestation with Cosign
• Attestation verified downstream
• Stored SBOMs re-scanned on Grype DB updates
• Findings correlated/prioritized (EPSS/KEV) and tracked to remediation