mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Completed upto lesson 30

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-23 15:53:35 +06:00
parent 8e43c00cd6
commit f1b693a147
6 changed files with 21754 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lessons/0030-generate-image-sbom.html Normal file
View File

@@ -0,0 +1 @@
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 30: Generate an image SBOM</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0030 · 25 minutes · Supply Chain Security</p><h1>Generate an SBOM before approving an image</h1><p class="lede">An SBOM is an inventory of software components in an artifact. It supports vulnerability response, license review, and incident investigation, but it does not by itself prove that an image is safe.</p><h2>Timed task: 15 minutes</h2><p>From the CKS workspace, generate a CycloneDX JSON SBOM for <code>nginx:1.27-alpine</code> and save it as <code>lab/lesson-30-sbom.json</code>.</p><pre><code>docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json &gt; .\lab\lesson-30-sbom.json</code></pre><p>Create <code>lab/lesson-30-answer.md</code> with:</p><ul><li>the exact command you ran;</li><li>the image reference and SBOM format;</li><li>three component names and versions from the generated SBOM; and</li><li>one sentence explaining why an SBOM helps after a new CVE, plus one sentence explaining what an SBOM alone does not establish.</li></ul><p>Do not use <code>latest</code>, alter the generated JSON, or claim that the SBOM is a vulnerability scan.</p><div class="callout"><strong>Exam reflex:</strong> pin tool and workload versions whenever possible. Repeatable evidence lets you compare what changed between releases.</div><h2>Useful PowerShell inspection</h2><pre><code>(Get-Content .\lab\lesson-30-sbom.json -Raw | ConvertFrom-Json).components | Select-Object name,version -First 10</code></pre><h2>Documentation target</h2><p>See the official <a href="https://github.com/anchore/syft">Syft documentation</a>; it supports container-image scanning and CycloneDX JSON output.</p><h2>What to send me</h2><p>Save both files, then say <em>check</em>. I’ll validate the evidence one item at a time.</p></main></body></html>