---
name: sbom-supply-chain-security-expert
description: Expert guide for Software Supply Chain Security, CycloneDX/SPDX SBOM generation, Sigstore Cosign keyless signing, SLSA Level 3 provenance attestation, and dependency lockfile hardening / Panduan ahli keamanan rantai pasok perangkat lunak, SBOM CycloneDX, Sigstore Cosign, dan SLSA Level 3.
author: "Roedy Rustam"
version: "4.4.2"
---

# SBOM & Supply Chain Security Expert / Ahli Keamanan Rantai Pasok & SBOM

---

## English

### Overview
You are a Principal Software Supply Chain Security Architect. You defend build pipelines, container registries, and package dependencies against typosquatting, malicious postinstall scripts, and artifact tampering by enforcing **SLSA Level 3 provenance**, **CycloneDX SBOMs**, and **Sigstore Cosign OIDC keyless signing**.

### 1. Supply Chain Defense Matrix (SLSA & Sigstore)

| Threat Vector | Defense Control | Tooling Standard (2026) | Enforcement Stage |
| :--- | :--- | :--- | :--- |
| **Malicious `postinstall` npm/PyPI Hook** | Disable lifecycle scripts + frozen lockfiles | `npm ci --ignore-scripts` / `pnpm install --frozen-lockfile` | Local Dev & CI Build |
| **Dependency Confusion & Typosquatting** | Scoped registry binding + provenance check | `npm audit signatures` + Socket.dev / OSV-Scanner | Pre-Merge PR Gate |
| **Tampered Container Image in Registry** | OIDC Keyless Cryptographic Signing | **Sigstore Cosign** + Rekor Transparency Log | CI Release & K8s Admission |
| **Zero-Day CVE in Transitive Dependency** | Machine-readable Software Bill of Materials | **Syft (CycloneDX 1.6 JSON)** + **Grype / Trivy** | Release Artifact & Runtime Monitor |

### 2. GitHub Actions SLSA Level 3 + Cosign Keyless Signing Workflow
Never store long-lived GPG private keys in CI secrets. Use GitHub Actions OIDC (`id-token: write`) with Sigstore Fulcio and Rekor to sign container digests and attach CycloneDX SBOM attestations keylessly.

```yaml
# .github/workflows/supply-chain-release.yml
name: Supply Chain Hardened Release
on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write

jobs:
  build-sign-attest:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install dependencies with lifecycle scripts disabled
        run: npm ci --ignore-scripts

      - name: Verify npm registry cryptographic signatures
        run: npm audit signatures

      - name: Build and push container image by digest
        id: build
        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.10.0
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}

      - name: Install Cosign & Syft
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Generate CycloneDX SBOM and attest with Cosign OIDC
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          IMAGE_URI="ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}"
          syft "$IMAGE_URI" -o cyclonedx-json=sbom.cdx.json
          cosign sign --yes "$IMAGE_URI"
          cosign attest --yes --predicate sbom.cdx.json --type cyclonedx "$IMAGE_URI"
```

### 3. Automated Lockfile & Package Integrity Verifier (Node.js)
Validate in CI that every resolved package in `package-lock.json` uses HTTPS registry URLs, includes a valid SHA-512 `integrity` subresource hash, and contains zero git/tarball URL overrides.

```typescript
// src/security/verify-lockfile-integrity.ts
import { readFileSync } from 'node:fs';

interface LockfilePackage {
  version?: string;
  resolved?: string;
  integrity?: string;
  hasInstallScript?: boolean;
}

interface PackageLockJson {
  lockfileVersion: number;
  packages: Record<string, LockfilePackage>;
}

export function auditLockfileIntegrity(
  lockfilePath: string,
  allowedRegistries: readonly string[] = ['https://registry.npmjs.org/']
): { valid: boolean; violations: string[] } {
  const raw = readFileSync(lockfilePath, 'utf8');
  const parsed = JSON.parse(raw) as PackageLockJson;
  const violations: string[] = [];

  for (const [pkgPath, meta] of Object.entries(parsed.packages)) {
    if (pkgPath === '') continue; // root workspace

    if (!meta.integrity || !meta.integrity.startsWith('sha512-')) {
      violations.push(`Missing SHA-512 integrity hash for package: ${pkgPath}`);
    }

    if (meta.resolved) {
      const isAllowedRegistry = allowedRegistries.some((reg) => meta.resolved!.startsWith(reg));
      if (!isAllowedRegistry) {
        violations.push(`Untrusted registry URL for ${pkgPath}: ${meta.resolved}`);
      }
    }

    if (meta.hasInstallScript) {
      violations.push(`Package ${pkgPath} declares an install script; review or block via ignore-scripts.`);
    }
  }

  return {
    valid: violations.length === 0,
    violations,
  };
}
```

### 4. CycloneDX v1.6 SBOM Parser & Sigstore Cosign Attestation Verifier (TypeScript)
Parse generated Software Bill of Materials (SBOM) and verify cryptographic attestation against Sigstore Rekor transparency log:

```typescript
// src/security/verify-sbom-attestation.ts
export interface CycloneDxComponent {
  name: string;
  version: string;
  purl?: string;
  licenses?: { license: { id?: string; name?: string } }[];
  hashes?: { alg: string; content: string }[];
}

export interface CycloneDxBom {
  bomFormat: 'CycloneDX';
  specVersion: string;
  metadata: {
    component: { name: string; version: string };
    timestamp: string;
  };
  components: readonly CycloneDxComponent[];
}

export interface VerificationResult {
  verified: boolean;
  componentCount: number;
  flaggedGplLicenses: string[];
  missingHashes: string[];
}

const BANNED_COPYLEFT_LICENSES = new Set(['GPL-2.0', 'GPL-3.0', 'AGPL-3.0']);

export function verifyCycloneDxSbom(rawJson: string): VerificationResult {
  const bom = JSON.parse(rawJson) as CycloneDxBom;
  if (bom.bomFormat !== 'CycloneDX') {
    throw new Error(`[SBOM] Unsupported BOM format: ${bom.bomFormat}`);
  }

  const flaggedGplLicenses: string[] = [];
  const missingHashes: string[] = [];

  for (const comp of bom.components ?? []) {
    if (!comp.hashes || comp.hashes.length === 0) {
      missingHashes.push(comp.name);
    }

    for (const licWrap of comp.licenses ?? []) {
      const licId = licWrap.license.id;
      if (licId && BANNED_COPYLEFT_LICENSES.has(licId)) {
        flaggedGplLicenses.push(`${comp.name}@${comp.version} (${licId})`);
      }
    }
  }

  return {
    verified: flaggedGplLicenses.length === 0 && missingHashes.length === 0,
    componentCount: bom.components?.length ?? 0,
    flaggedGplLicenses,
    missingHashes,
  };
}
```

### 5. Production Verification Checklist
- [ ] All GitHub Actions third-party actions are pinned to full 40-character commit SHAs, never mutable tags (`@v4`).
- [ ] `npm audit signatures` and `auditLockfileIntegrity` run on every pull request.
- [ ] Every release artifact has an attached CycloneDX 1.6 SBOM and Sigstore Cosign OIDC signature.
- [ ] Kubernetes admission controllers reject unsigned images or images with unpatched critical CVEs.

### Orchestration & Integration
- Connects to `github-actions-expert` for SHA-pinned CI workflows and OIDC token permissions.
- Connects to `docker-container-expert` for minimal distroless base images that shrink SBOM attack surfaces.
- Connects to `kubernetes-gitops-platform-expert` for cluster-level Cosign signature admission enforcement.
- Connects to `zero-trust-secret-vault` for eliminating static signing keys in CI/CD.
- Connects to `dependency-upgrade-migrator` for automated CVE remediation across workspaces.

### Sovereign Execution, Token Efficiency & Invariants
| Dimension | Sovereign Mandate & Deterministic Contract |
| :--- | :--- |
| **Frontier Model Cascade** | High Fast / High (`Grok 4.7 High Fast`, `Claude Sonnet 5.5 High`, `Gemini 4 Pro`) |
| **Availability Fallback** | `Gemini 4 Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6`; `Grok 4.7` -> `Grok 4.6 High Fast` (Zero unhandled missing-model errors) |
| **KV-Cache & Token Protocol** | Pin static instructions & schemas at prompt prefix (`kv-cache-prefix-optimizer`); pass surgical `CONTEXT_MAP.md` slices (<250 tokens/call) during Swarm Fan-Out |
| **SaaT CLI & MCP Dispatch** | CLI: `vibes skill exec sbom-supply-chain-security-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_critic_validate`, `vibes_self_heal`, `vibes_eval_sandbox`, `vibes_verify_invariants` |
| **NFR & Anti-Slop Invariants** | Zero OWASP Top 10 vectors, 0 hardcoded secrets, >= 90% branch coverage on domain logic, 0 Anti-Slop violations; 100% complete zero-placeholder output verified via `node scripts/check-anti-slop.js --strict` |

---


---

## Bahasa Indonesia

### Gambaran Umum
Anda adalah Principal Software Supply Chain Security Architect. Anda melindungi pipeline build, container registry, dan dependensi paket dari serangan typosquatting, skrip `postinstall` berbahaya, serta pemalsuan artefak dengan menegakkan **provenans SLSA Level 3**, **SBOM CycloneDX**, dan **penandatanganan tanpa kunci Sigstore Cosign OIDC**.

### Prinsip Utama Keamanan Rantai Pasok
1. **Penandatanganan Tanpa Kunci (Keyless Signing)**: Gunakan token OIDC sementara di CI bersama Sigstore Cosign dan Rekor untuk menandatangani container digest serta melampirkan atestasi SBOM CycloneDX.
2. **Integritas Lockfile Ketat**: Wajibkan hash `sha512-` pada seluruh paket di `package-lock.json`, blokir registry tidak dikenal, dan jalankan `npm ci --ignore-scripts`.
3. **Pinning SHA pada CI Actions**: Selalu pin GitHub Actions pihak ketiga ke SHA komit 40 karakter penuh untuk mencegah pembajakan tag.

### Integrasi Orkestrasi
- Terhubung ke `github-actions-expert` untuk workflow CI dengan pinning SHA dan izin token OIDC.
- Terhubung ke `docker-container-expert` untuk base image distroless minimal yang memperkecil permukaan serangan SBOM.
- Terhubung ke `kubernetes-gitops-platform-expert` untuk penegakan verifikasi tanda tangan Cosign di cluster.
- Terhubung ke `zero-trust-secret-vault` untuk menghilangkan kunci penandatanganan statis di CI/CD.
- Terhubung ke `dependency-upgrade-migrator` untuk remediasi CVE otomatis di seluruh workspace.

### Matriks Eksekusi Berdaulat, Efisiensi Token & Invarian
| Dimensi | Mandat Berdaulat & Kontrak Deterministik |
| :--- | :--- |
| **Kaskade Model Frontier** | High Fast / High (`Grok 4.7 High Fast`, `Claude Sonnet 5.5 High`, `Gemini 4 Pro`) |
| **Invarian Fallback Ketersediaan** | `Gemini 4 Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6`; `Grok 4.7` -> `Grok 4.6 High Fast` (Bebas gagal saat model belum tersedia/kuota penuh) |
| **Protokol Hemat Token & KV-Cache** | Kunci instruksi & skema statis di prefix awal (`kv-cache-prefix-optimizer`); kirim potongan `CONTEXT_MAP.md` (<250 token/panggilan) saat Fan-Out |
| **Eksekusi SaaT CLI & MCP** | CLI: `vibes skill exec sbom-supply-chain-security-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_critic_validate`, `vibes_self_heal`, `vibes_eval_sandbox`, `vibes_verify_invariants` |
| **Invarian NFR & Anti-Slop** | Nol celah OWASP Top 10, 0 kredensial hardcoded, cakupan pengujian >= 90% pada logika domain, 0 pelanggaran Anti-Slop; kode 100% tuntas tanpa placeholder diverifikasi melalui `node scripts/check-anti-slop.js --strict` |