Tabular Foundation Models (TFMs) logopeterindia.net
Knowledge Hub

Software Supply Chain Security

Software supply chain security explained: SBOMs, provenance, signing, VEX, open standards, open-source tools and commercial platforms.

33 topics•6 categories•Updated October 2026

What Is Software Supply Chain Security?

4 entries

Software supply chain security protects the code, dependencies, build systems and artifacts that go into software. Common practices are generating a software bill of materials (SBOM) that lists components, scanning those components for known vulnerabilities, signing artifacts, recording build provenance so a binary can be traced to its source, and publishing VEX statements that say whether a vulnerability actually affects a product. Government guidance such as NIST's Secure Software Development Framework (SSDF) and CISA's SBOM resources describe these practices.

01NIST Secure Software Development Framework (SSDF)NIST's project page for SP 800-218 and its community profiles, including one for generative AI and dual-use foundation models. 02CISA SBOM resourcesCISA's collection of guidance on software bills of materials. 03CISA Secure Software Development Attestation FormCISA's page for the self-attestation form for secure software development. 04GitHub supply chain security documentationGitHub documentation on securing the software supply chain, including dependency graph and artifact attestations.

Frameworks and Standards

5 entries

Open specifications for describing components, provenance and vulnerability status.

05SLSASecurity framework that describes itself as a checklist of standards and controls to prevent tampering and improve integrity of packages and infrastructure. 06CycloneDX (OWASP)Bill of Materials standard whose site describes support for SBOMs and related BOM types. 07SPDXOpen standard for communicating software bill of materials information, including components, licenses and security references. 08OpenVEXSpecification for Vulnerability Exploitability eXchange statements that say whether a vulnerability affects a product. 09in-totoFramework to secure the integrity of software supply chains by verifying each step.

SBOM Generation and Vulnerability Scanning

8 entries

Open-source tools that generate SBOMs and match components against vulnerability data. Release facts are from each repository's GitHub page.

10SyftCLI tool and library for generating SBOMs from container images and filesystems (Apache-2.0); GitHub lists v1.55.0 as the latest release, from 19 October 2026. 11GrypeVulnerability scanner for container images and filesystems (Apache-2.0); GitHub lists v0.121.0 as the latest release, from 19 October 2026. 12TrivyScanner for vulnerabilities, misconfigurations, secrets and SBOM across containers, Kubernetes and code (Apache-2.0); GitHub lists v0.76.1 as the latest release, from 21 October 2026. 13OSV-Scanner (Google)Vulnerability scanner that uses data from osv.dev (Apache-2.0); GitHub lists v2.7.0 as the latest release, from 12 October 2026. 14OWASP Dependency-TrackComponent analysis platform for tracking SBOMs and vulnerabilities (Apache-2.0); GitHub lists 5.2.1 as the latest release, from 25 October 2026. 15OWASP Dependency-CheckSoftware composition analysis tool that identifies known vulnerable dependencies. 16CycloneDX CLICLI tool for SBOM analysis, merging, diffs and format conversion (Apache-2.0); GitHub lists v0.33.1 as the latest release, from 23 July 2026. 17GUACAggregates software security metadata into a graph database (Apache-2.0); GitHub lists v1.1.0 as the latest release, from 13 March 2026.

Signing, Provenance and Project Health

6 entries

Tools that sign artifacts, generate provenance and assess how well open-source projects follow security practices.

18SigstoreSigning and verification project whose site says to sign, verify and protect so software is what it claims to be. 19CosignCode signing and transparency tool for containers and binaries (Apache-2.0); GitHub lists v3.1.4 as the latest release, from 20 October 2026. 20in-toto (GitHub)Reference implementation of the in-toto framework; GitHub lists v3.1.0 as the latest release, from May 2026. 21SLSA GitHub generatorLanguage-agnostic SLSA provenance generation for GitHub Actions (Apache-2.0); GitHub lists v2.1.0, from February 2025, as the latest release, though the repository was updated in August 2026. 22vexctlTool to create, transform and attest VEX metadata (Apache-2.0); GitHub lists v0.4.4 as the latest release, from June 2026. 23OpenSSF ScorecardSecurity health metrics for open-source projects; GitHub lists v5.6.0 as the latest release, from 12 October 2026.

Commercial Platforms

4 entries

Vendor products for software supply chain security. Descriptions follow each vendor's own pages and are not independent evaluations.

24ChainguardDescribes providing trusted open-source artifacts for containers, language libraries and VM images. 25SnykDeveloper security platform; its site describes securing code, AI agents and applications. 26SonatypeDescribes intelligence and automated governance for open source and AI, from the creators of Nexus Repository. 27FOSSADescribes automated SBOM generation, software composition analysis, license compliance and vulnerability management.

Frequently Asked Questions

What is an SBOM?

A software bill of materials is a list of the components in a piece of software, usually in a standard format such as CycloneDX or SPDX, so users can check which components and versions they are running.

What is SLSA?

SLSA is a security framework of standards and controls for preventing tampering and improving the integrity of packages and build infrastructure, including provenance that records how an artifact was built.

What is VEX?

Vulnerability Exploitability eXchange statements say whether a known vulnerability actually affects a product, which reduces noise from scanners. OpenVEX and CycloneDX both support it.

What does Sigstore do?

Sigstore provides tooling to sign and verify software artifacts, with Cosign used to sign and verify containers and binaries and a public transparency log for signatures.

Where should I start?

Generate an SBOM in CI with a tool such as Syft or Trivy, scan it with Grype or OSV-Scanner, sign release artifacts with Cosign, and measure your dependencies with OpenSSF Scorecard. Then add provenance as your build system allows.

How current is this page?

Links were checked on 31 October 2026. Release facts are from GitHub, and vendor descriptions follow each vendor's own pages and are not independent evaluations. The SLSA GitHub generator's latest release is from February 2025, so check it against your build platform.