Software Supply Chain Security for Kubernetes: Sigstore, SLSA & SBOM Guide

Sigstore — Signing & Verification

Sigstore is an open-source project (Linux Foundation) that makes signing and verifying software artifacts free and easy:

• cosign: Sign and verify container images and other OCI artifacts
• Rekor: Immutable transparency log — every signature is recorded publicly, providing tamper-evident audit trail
• Fulcio: Certificate authority that issues short-lived certificates based on OIDC identity (no key management needed)

Keyless signing: Sigstore's killer feature. Developers sign with their GitHub/Google/Microsoft identity — no GPG keys to manage, rotate, or lose. The ephemeral certificate ties the signature to a verified identity.

SLSA Framework

Supply chain Levels for Software Artifacts — a graduated framework for supply chain integrity:

• SLSA Level 1: Build process documented. Provenance exists but isn't verified.
• SLSA Level 2: Build process authenticated. Provenance generated by a hosted build service.
• SLSA Level 3: Hardened builds. Build platform provides strong assurances — hermetic, reproducible, auditable.
• SLSA Level 4: Two-person review + hermetic builds. Highest assurance level.

Target for regulated enterprises: SLSA Level 3 is the practical target. Achievable with Tekton Chains, GitHub Actions provenance, or GitLab's CI/CD with signing.

SBOM — Software Bill of Materials

• What: A machine-readable inventory of every component in your software — libraries, frameworks, OS packages, transitive dependencies
• Formats: CycloneDX (OWASP) and SPDX (Linux Foundation) are the two standards
• Generation: Trivy, Syft, or build-tool integrations generate SBOMs automatically
• Verification: Attach SBOMs as signed attestations to container images (cosign attest)
• Consumption: Dependency-Track or Grype can scan SBOMs for known vulnerabilities

CRA requirement: Manufacturers must provide SBOM documentation (top-level dependencies minimum). This is mandatory from December 2027, but vulnerability reporting obligations start September 2026.

1. Build: CI pipeline builds container image in hermetic environment
2. Scan: Trivy scans for vulnerabilities and generates SBOM
3. Sign: cosign signs the image with keyless signing (Sigstore)
4. Attest: cosign attaches SBOM and provenance as signed attestations
5. Store: Push signed image + attestations to OCI-compliant registry
6. Verify: Kubernetes admission controller (Kyverno/OPA) verifies signature and attestations before allowing deployment
7. Monitor: Continuous SBOM scanning in production for newly disclosed vulnerabilities

1. Start with container image signing — Add cosign signing to your CI pipeline (one step, 5 minutes)
2. Generate SBOMs — Add Trivy or Syft SBOM generation to your build process
3. Deploy admission control — Kyverno image verification policy to block unsigned images
4. Set up SBOM monitoring — Dependency-Track for continuous vulnerability monitoring of your SBOM inventory
5. Document your SLSA level — Assess your current level and create a roadmap to Level 3