Lion Cipher Lab

Generate a software bill of materials (SBOM) with Syft

• Cloud Security
• Beginner
• ~50 min
• Free · no account required

Why it matters

Almost no software is written from scratch anymore. A modern app is assembled: your code sits on top of dozens or hundreds of PACKAGES -- pre-built pieces of software written by other people -- and those packages depend on still more packages, layers deep. This web of borrowed components is called the SOFTWARE SUPPLY CHAIN, and for most teams it is a black box: they genuinely do not have a full list of what is inside the thing they ship. That blind spot has real consequences. In the SolarWinds incident, malicious code rode in through the build pipeline of trusted software and reached…

What you'll learn

• understanding what a 'package', a 'dependency', and a 'transitive dependency' are, from zero
• understanding what the 'software supply chain' is and why 'know what is in your software' became a priority after the SolarWinds incident
• understanding what an SBOM (software bill of materials) is and what problem it solves
• understanding the two standard SBOM formats -- SPDX and CycloneDX -- and why a standard format matters
• installing Syft, the free open-source SBOM generator from Anchore, on Windows, macOS, or Linux
• generating an SBOM for a public container image and saving it in both SPDX and CycloneDX
• generating an SBOM for a local project directory on your own machine
• reading an SBOM: package names, exact versions, and the licenses each component ships under
• installing Grype, the free open-source vulnerability scanner, and feeding your SBOM to it to produce a list of known vulnerabilities (CVEs)
• doing all of this locally, read-only, against a public image and a folder you created yourself

Steps in this lab

1. What this lab is, and why inventorying software is completely safe
2. The words you need first: package, dependency, transitive dependency, supply chain, SBOM (from zero)
3. Why 'know what is in your software' became a priority: SolarWinds, and the two standard formats
4. Optional: install Docker so you can inventory a public image
5. Install Syft (the free SBOM generator)
6. Install Grype (the free vulnerability scanner)
7. Generate your first SBOM: inventory a public container image
8. Read the SBOM: package names, exact versions, and licenses
9. Do it for your own code: inventory a local project directory
10. Turn the inventory into answers: feed the SBOM to Grype
11. Why this one skill makes you a defender, and where it goes next

Open the full interactive lab →