Cryptographic Supply Chain Security

SLSA-3 Cryptographic Supply Chain & DevSecOps Platform

End-to-end provenance architecture generating CycloneDX SBOMs, keyless Sigstore Cosign signatures, and Kyverno admission controls blocking unsigned container images in production.

📖 Project Overview

Modern CI/CD pipelines and microservice registries are prime vectors for sophisticated supply chain compromises (e.g., SolarWinds, Codecov, dependency typosquatting). Deploying third-party or internal container images without verifiable provenance creates severe enterprise vulnerability risks.

This system establishes an end-to-end Supply-chain Levels for Software Artifacts (SLSA) Level 3 compliant governance platform. Integrated into GitHub Actions pipelines, it automatically extracts standardized CycloneDX JSON SBOMs, validates dependencies with Trivy against national vulnerability databases, and applies cryptographic keyless container signing via Sigstore Cosign using ephemeral OIDC identities.

Attestations are immutably logged to the public Rekor transparency ledger. At cluster admission time, Kyverno admission controllers intercept every Pod deployment request, strictly verifying signatures and denying any unsigned artifact or high-severity CVE before it reaches Kubernetes nodes.

⚙️ Deployment Checklist & Runbook

Generate CycloneDX SBOM & Scan with Trivy

Extract deep dependency trees and CVE vulnerability reports during container builds:

yaml

- name: Generate CycloneDX SBOM
  uses: CycloneDX/gh-node-module-generatebom@v1
  with:
    output: bom.json

- name: Vulnerability Scan with Trivy
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    ignore-unfixed: true
    format: 'sarif'
    severity: 'CRITICAL,HIGH'

Sign Container Image Keylessly with Sigstore Cosign

Publish image attestation to Rekor using GitHub OIDC workload identity:

bash

# Sign image using OIDC token (no long-lived private keys):
cosign sign --yes \
  ghcr.io/pradeeptalari14/enterprise-platform:v2.4.0

# Attach and sign the CycloneDX SBOM attestation:
cosign attest --yes \
  --predicate bom.json \
  --type cyclonedx \
  ghcr.io/pradeeptalari14/enterprise-platform:v2.4.0

Deploy Kyverno Zero-Trust Admission Policy

Enforce cluster-wide rule blocking deployment of unsigned container images:

yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-cosign-signature
spec:
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 30
  rules:
  - name: verify-signature-rule
    match:
      any:
      - resources:
          kinds: ["Pod"]
    verifyImages:
    - imageReferences: ["ghcr.io/pradeeptalari14/*"]
      attestors:
      - entries:
        - keyless:
            issuer: https://token.actions.githubusercontent.com
            subject: https://github.com/Pradeeptalari14/*

🔄 Configuration & Environment Keys

Environment Variable	Description	Suggested Value
`COSIGN_EXPERIMENTAL`	Enable keyless OIDC Fulcio / Rekor workflows.	`1`
`REKOR_SERVER_URL`	Sigstore public or enterprise transparency log.	`https://rekor.sigstore.dev`
`KYVERNO_FAILURE_ACTION`	Enforcement action for unverified image admission.	`Enforce` (blocks pod creation)
`MAX_ALLOWED_CVE_SEVERITY`	Highest permitted CVE threshold in production pipelines.	`MEDIUM`

📊 Architectural Workflow

graph TD
    Dev([Developer Commit]) -->|Git Push| Pipeline[GitHub Actions CI Runner]
    Pipeline -->|Docker Build| BuildImage[Container Image Artifact]
    Pipeline -->|Generate SBOM| CycloneDX[CycloneDX JSON Generator]
    Pipeline -->|Vulnerability Gate| Trivy[Trivy Security Scanner]
    Trivy -->|Scan Clean| CosignSign[Sigstore Cosign Keyless Signer]
    CosignSign -->|Fulcio Certificate| OIDC[(GitHub OIDC Workload ID)]
    CosignSign -->|Publish Log Entry| Rekor[(Rekor Transparency Ledger)]
    CosignSign -->|Push Image + Attestation| Registry[(Container Registry GHCR)]
    ArgoCD[ArgoCD GitOps] -->|Deploy Request| K8sAPI[Kubernetes API Server]
    K8sAPI -->|Admission Webhook| Kyverno[Kyverno Policy Engine]
    Kyverno -->|Verify Cosign Signature| Rekor
    Kyverno -->|Signature Validated| WorkerNodes[Deploy to Production Pods]

🛠️ Useful CLI Reference

# Verify signature of live production image:
cosign verify \
  --certificate-identity-regexp="https://github.com/Pradeeptalari14/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pradeeptalari14/enterprise-platform:v2.4.0

# Inspect Kyverno cluster policy violation reports:
kubectl get clusterpolicyreports -A