Security · Advanced
Supply-Chain Security Scanner
Build a CLI that generates an SBOM for a repo, flags known CVEs and risky transitive dependencies, verifies build provenance with signatures, and gates a CI pipeline on policy.
You build a Go CLI tool that scans any repository, produces a CycloneDX or SPDX software bill of materials using Syft, then pipes it through Grype to surface CVEs against the NVD and OSV databases. The tool also verifies container image and artifact signatures via Sigstore cosign and checks SLSA provenance attestations, then enforces a configurable policy file that can block a CI pipeline on severity thresholds or missing attestations. This project directly addresses the class of attacks demonstrated by SolarWinds and XZ Utils, making it immediately relevant to production engineering.
What you build
- Generate a standards-compliant SBOM (SPDX or CycloneDX) for any Go, Node, Python, or container image target
- Scan the SBOM against CVE databases (NVD, OSV, GitHub Advisory) with severity scores via Grype
- Verify Sigstore cosign signatures and Rekor transparency log entries for build artifacts
- Validate SLSA provenance attestations to confirm trusted build provenance
- Enforce a YAML policy file specifying allowed CVE severity thresholds, required attestation fields, and blocked packages
- Output structured JSON or human-readable reports suitable for CI artifact upload
- Exit with a non-zero code on policy violation, natively gating GitHub Actions or any CI system
What it teaches
- How software bills of materials are structured and why they matter for supply-chain auditing
- CVE scoring systems (CVSS v3/v4) and how vulnerability databases (NVD, OSV, GitHub Advisory) differ
- Sigstore's keyless signing model: ephemeral keys, OIDC identity, and the Rekor transparency log
- SLSA provenance levels and how to verify a provenance attestation bundle against a known builder
- Building policy-as-code that turns security scan output into a hard CI gate
- Go CLI design patterns: subcommands, structured JSON output, and subprocess orchestration
How it works
- 1
Target input
- Repo directory or OCI image reference
- 2
SBOM generation
- Syft scans dependencies
- Emits CycloneDX or SPDX JSON
- 3
Vulnerability scan
- Grype matches packages to NVD / OSV
- Returns CVE list with CVSS scores
- 4
Provenance verification
- cosign checks signature + Rekor log
- SLSA bundle validates builder identity
- 5
Policy gate
- YAML policy evaluated against findings
- Non-zero exit blocks CI merge
Sign in to open the build guide
Free account. Get the step-by-step build and every resource link.
Take it further
- Add an SBOM diff subcommand that compares two SBOM snapshots and highlights new or removed packages between commits
- Integrate OSV-Scanner as an additional vulnerability source and merge findings with deduplication by CVE ID
- Build a simple web dashboard (served by the CLI itself) that renders the vulnerability tree with filter and search controls
