Lion Cipher Lab
Build an SBOM diff tool that shows what a pull request adds to your dependencies
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every pull request (a proposed change to a codebase that teammates review before it is merged) can quietly change what your software is built from: a new library, a library pulled in by that library, an older version, a new license. Reviewers read the code diff and skim past the lockfile. An SBOM diff turns that hidden change into a short list a human can actually review, and into rules a pipeline can enforce. Building the tool yourself teaches you exactly what an SBOM can and cannot prove, which is the judgment a supply-chain security role is hired for.
What you'll learn
- reading a CycloneDX JSON SBOM: components, purls, licenses, and the dependencies graph
- using a package URL (purl) minus its version as a component's identity
- normalising PyPI names per the purl spec (lowercase, underscore becomes dash) and measuring what skipping it costs
- telling direct dependencies from transitive ones using the SBOM's dependency graph
- comparing versions safely enough to catch a downgrade, and knowing where a simple comparator breaks
- flagging new names one edit away from an existing name as possible typosquats
- scoring a home-made tool against an answer key (found, missed, false alarms)
- turning a diff into a CI gate with exit codes: fail on downgrade, new copyleft or typosquat; warn on new direct dependencies
- deciding when an SBOM diff is worth it and when a lockfile diff in code review is enough
Steps in this lab
- What you are building, and the words you need
- Set up: a terminal, Python, and a working folder
- Create the two SBOMs and the answer key
- Write the tool: sbomdiff.py, section by section
- Measure the noise: what a plain line diff shows
- Run it, read the report, and score it against the key
- Break it on purpose: switch off purl normalisation
- Where the tool is wrong, and what an SBOM diff can never tell you
- Judgment: when an SBOM diff is the right gate, and how a pro wires it into CI
- Optional: run it on a real project of your own with Syft