2 lines
2.0 KiB
HTML
2 lines
2.0 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 30: Generate an image SBOM</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0030 · 25 minutes · Supply Chain Security</p><h1>Generate an SBOM before approving an image</h1><p class="lede">An SBOM is an inventory of software components in an artifact. It supports vulnerability response, license review, and incident investigation, but it does not by itself prove that an image is safe.</p><h2>Timed task: 15 minutes</h2><p>From the CKS workspace, generate a CycloneDX JSON SBOM for <code>nginx:1.27-alpine</code> and save it as <code>lab/lesson-30-sbom.json</code>.</p><pre><code>docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json</code></pre><p>Create <code>lab/lesson-30-answer.md</code> with:</p><ul><li>the exact command you ran;</li><li>the image reference and SBOM format;</li><li>three component names and versions from the generated SBOM; and</li><li>one sentence explaining why an SBOM helps after a new CVE, plus one sentence explaining what an SBOM alone does not establish.</li></ul><p>Do not use <code>latest</code>, alter the generated JSON, or claim that the SBOM is a vulnerability scan.</p><div class="callout"><strong>Exam reflex:</strong> pin tool and workload versions whenever possible. Repeatable evidence lets you compare what changed between releases.</div><h2>Useful PowerShell inspection</h2><pre><code>(Get-Content .\lab\lesson-30-sbom.json -Raw | ConvertFrom-Json).components | Select-Object name,version -First 10</code></pre><h2>Documentation target</h2><p>See the official <a href="https://github.com/anchore/syft">Syft documentation</a>; it supports container-image scanning and CycloneDX JSON output.</p><h2>What to send me</h2><p>Save both files, then say <em>check</em>. I’ll validate the evidence one item at a time.</p></main></body></html>
|