The Software Bill of Materials (SBOM) is not produced

steps_sbom

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Family

SCM

Description

SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process.

It should be generated after every pipeline run. After it is generated, it must then be signed.

You can configure tools or run commands to check for workflows using tools to verify this. The parameters are tools and commands.

Security

Software Bill of Materials (SBOM) is a file used to validate the integrity and security of a build pipeline.

Signing it ensures that no one tampered with the file when it was delivered. Such interference can happen if someone tries to hide unusual activity.

Validating the SBOM signature can detect this activity and prevent much greater incidents.

Mitigation / Fix

Generate the Software Bill of Materials as a step of the pipeline that builds the artifact, so the SBOM describes the components that actually went into that build rather than a later state of the repository. The check looks for a known SBOM tool in the pipeline definitions and build scripts of the project.

This check reads pipeline definitions and build scripts only. An SBOM produced anywhere else — by hand, or by a pipeline living in another repository — is not visible to it, so the finding stays open until the generating step belongs to a pipeline this project owns.

Xygeni SBOM

Xygeni exports the SBOM from the dependency graph it resolved for the scan, so the inventory matches what the build resolved:

xygeni inventory -n $PROJECT -d . --sbom sbom.json

On GitHub Actions the same export is available as an action:

- name: Xygeni SBOM
  uses: xygeni/xygeni-action@<commit-sha> # pin to a release commit
  with:
    command: sbom
    token: ${{ secrets.XYGENI_TOKEN }}

An unsigned SBOM travels without provenance: anyone downstream has to take it on trust. Attest it in the same pipeline run that produced it, adding the SBOM as a product of the build with Salt:

salt -q -p $PIPE -s sbom -d . \
     -t product -f sbom.json \
     -- xygeni inventory -n $PROJECT -d . --sbom sbom.json