DevSecOps › Module 8 › Lesson 4
Lab — Supply
Runtime and supply chain lab on `$DEVSEC_LAB` — runtime guard card, SBOM card, dependency risk register bundled.
Visual · t36_supply_lab
Lab: supply chain pack on YOUR $DEVSEC_LAB. Original Cyberlium.
Opening
Ship supply chain artifacts from YOUR lab — runtime, SBOM, dependency risk — zero forged SBOMs or malicious package recipes.
On YOUR `$DEVSEC_LAB` per brief: (1) scope proof — lab deploy manifest and repo labeled; (2) runtime guard card Module 8-1; (3) SBOM card Module 8-2; (4) dependency risk register Module 8-3; (5) supply chain summary stub (component count, open CVE count, priority upgrade); (6) integrity — `$DEVSEC_LAB` only, no stranger cluster tampering, no forged SBOMs, no typosquat recipes; (7) chmod 600 pack. Cross-link Modules 6–7 IaC and container work — professional supply chain literacy handoff.
1. Lab deliverables
Runtime + SBOM + dependency risk cross-indexed — single supply thread.
Summary cites honest open CVE count — not zero-fiction.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA SBOM — https://www.cisa.gov/sbom Syft — https://github.com/anchore/syft NIST SSDF PS.2 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/sbom-lab-summary.md" <<'EOF'
# SBOM Lab Summary — YOUR lab
- sbom-named.txt: SPDX/CycloneDX literacy
- checklist.md: syft optional or manual checklist
- supply-chain-response.md: CVE tabletop workflow
## Artifacts
- sbom.cyclonedx.json (if syft installed)
## Refusals
- YOUR repo only — no stranger supply chain scraping
EOFCommand — copy this
grep -E 'checklist|Refusals|syft' "$DEVSEC_LAB/notes/sbom-lab-summary.md" ls "$DEVSEC_SBOM/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/sbom/checklist.md | Select-String syft
Primary tools to practice this lesson: grep, syft. Reference sites: CISA SBOM (https://www.cisa.gov/sbom); Syft (https://github.com/anchore/syft); NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each component links SBOM row and risk register — not orphan entries.
Zero stranger org or malicious package notes in pack.
3. Teardown
Secure notes chmod 600; supply pack ready for findings module.
Archive stub optional per brief.
4. What you ship: supply lab pack
Runtime + SBOM + dependency risk + summary + integrity — chmod 600.
5. What you record before the next lesson
Supply lab pack path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Supply lab includes typosquat package upload recipe as bonus deliverable.
Right
Supply lab pack on `$DEVSEC_LAB`. Next: quiz.
Mission: supply lab
1) Scope and manifest/repo proof. 2) Runtime guard and SBOM cards. 3) Dependency risk register. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Supply summary — minimum metric rows?”
Knowledge Check
APPLY: Supply lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Typosquat recipes earn supply lab credit.
True or False
Knowledge Check
APPLY: Supply lab pack should:
Multiple choice