SBOM Named

SBOM literacy — SPDX/CycloneDX format, component list, version pin, provenance stub, vulnerability correlation — named SBOM rows on YOUR `$DEVSEC_LAB` artifacts.

SBOM Named• Audio Walkthrough

00:00/03:05

Visual · t36_sbom_named

SBOM = named component inventory rows. $DEVSEC_LAB. Original Cyberlium.

You cannot patch what you cannot inventory — name SBOM format and component rows on YOUR lab artifacts before claiming supply chain visibility on stranger org builds.

SBOM named literacy names: SBOM format category (SPDX, CycloneDX literacy stub), component name/version list category, dependency tree depth category, provenance/build metadata stub category, and vulnerability correlation category (link to Trivy/Checkov literacy). Analyst documents SBOM card on `$DEVSEC_LAB` lab image or repo — format stub, five component rows, correlation to Module 7 scan — without generating fake SBOMs for stranger org products, without SBOM-washing unreviewed dependencies, without supply chain attack recipes. Cyberlium teaches SBOM vocabulary on YOUR notes — transparency literacy only. Refused: forged SBOMs, stranger org artifact claims, malicious dependency injection guides. Lab row: SBOM card (format, five components, provenance stub, vuln correlation).

1. Named SBOM rows

Format, component list, dependency depth, provenance, vuln correlation — five literacy anchors.

Each component cites YOUR lab build output — not copied stranger SBOM.

Command guide

Try these commands — Named SBOM rows

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Syft — https://github.com/anchore/syft CISA SBOM — https://www.cisa.gov/sbom NIST SSDF — https://csrc.nist.gov/Projects/ssdf

═══ INSTALL ═══

Linux (Debian/Ubuntu):

macOS:

Windows:

═══ LINUX / macOS ═══

Command — copy this

export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_SBOM=${DEVSEC_SBOM:-$DEVSEC_LAB/sbom}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
echo '=== syft SBOM on YOUR sample-repo (optional if installed) ==='
if command -v syft >/dev/null; then syft packages "$DEVSEC_REPO" -o cyclonedx-json > "$DEVSEC_SBOM/sbom.cyclonedx.json" 2>&1 && head -20 "$DEVSEC_SBOM/sbom.cyclonedx.json"; else echo 'syft not installed — writing checklist instead'; fi
cat > "$DEVSEC_SBOM/checklist.md" <<'EOF'
# SBOM Checklist — YOUR lab repo
- [ ] Identify artifact: sample-repo + container/Dockerfile
- [ ] Generate SBOM: syft packages $DEVSEC_REPO -o cyclonedx-json
- [ ] Or: syft packages container/ -o spdx-json
- [ ] Store SBOM with release tag / build ID
- [ ] On CVE alert: map affected package via SBOM → patch → rebuild
- [ ] Verify SBOM signature / provenance (SLSA literacy — optional)
NEVER: generate SBOM from stranger repos without authorization
EOF

Command — copy this

grep -E '\[ \]|syft|NEVER' "$DEVSEC_SBOM/checklist.md"

Primary tools to practice this lesson: syft, grep. Reference sites: Syft (https://github.com/anchore/syft); CISA SBOM (https://www.cisa.gov/sbom); NIST SSDF (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Correlation discipline

SBOM components cross-reference Module 7 Trivy findings — same image thread.

Provenance stub documents build pipeline ID on lab stub — not silent unknown.

3. Refused

No forged SBOMs; no stranger org artifact SBOM claims; no malicious dependency guides.

SBOM literacy supports transparency — not supply chain theater.

4. What you ship: SBOM card

Format + five components + provenance stub + vuln correlation + NEVER forged SBOM line.

5. What you record before the next lesson

SBOM card path.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Publish fabricated SBOM for stranger org product claiming 'supply chain audit' without authorization.
Right: SBOM card from `$DEVSEC_LAB` lab artifact. Next: Dependency Risk.

Hands-on Exercise