Lesson 0030 · 25 minutes · Supply Chain Security

Generate an SBOM before approving an image

An SBOM is an inventory of software components in an artifact. It supports vulnerability response, license review, and incident investigation, but it does not by itself prove that an image is safe.

Timed task: 15 minutes

From the CKS workspace, generate a CycloneDX JSON SBOM for nginx:1.27-alpine and save it as lab/lesson-30-sbom.json.

docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json

Create lab/lesson-30-answer.md with:

• the exact command you ran;
• the image reference and SBOM format;
• three component names and versions from the generated SBOM; and
• one sentence explaining why an SBOM helps after a new CVE, plus one sentence explaining what an SBOM alone does not establish.

Do not use latest, alter the generated JSON, or claim that the SBOM is a vulnerability scan.

Useful PowerShell inspection

(Get-Content .\lab\lesson-30-sbom.json -Raw | ConvertFrom-Json).components | Select-Object name,version -First 10

Documentation target

See the official Syft documentation; it supports container-image scanning and CycloneDX JSON output.

What to send me

Save both files, then say check. I’ll validate the evidence one item at a time.