DevSecOps › Module 8 › Lesson 2
SBOM Named
SBOM literacy — SPDX/CycloneDX format, component list, version pin, provenance stub, vulnerability correlation — named SBOM rows on YOUR `$DEVSEC_LAB` artifacts.
Visual · t36_sbom_named
SBOM = named component inventory rows. $DEVSEC_LAB. Original Cyberlium.
Opening
You cannot patch what you cannot inventory — name SBOM format and component rows on YOUR lab artifacts before claiming supply chain visibility on stranger org builds.
SBOM named literacy names: SBOM format category (SPDX, CycloneDX literacy stub), component name/version list category, dependency tree depth category, provenance/build metadata stub category, and vulnerability correlation category (link to Trivy/Checkov literacy). Analyst documents SBOM card on `$DEVSEC_LAB` lab image or repo — format stub, five component rows, correlation to Module 7 scan — without generating fake SBOMs for stranger org products, without SBOM-washing unreviewed dependencies, without supply chain attack recipes. Cyberlium teaches SBOM vocabulary on YOUR notes — transparency literacy only. Refused: forged SBOMs, stranger org artifact claims, malicious dependency injection guides. Lab row: SBOM card (format, five components, provenance stub, vuln correlation).
1. Named SBOM rows
Format, component list, dependency depth, provenance, vuln correlation — five literacy anchors.
Each component cites YOUR lab build output — not copied stranger SBOM.
Command guide
Try these commands — Named SBOM rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Syft — https://github.com/anchore/syft CISA SBOM — https://www.cisa.gov/sbom NIST SSDF — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_SBOM=${DEVSEC_SBOM:-$DEVSEC_LAB/sbom}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
echo '=== syft SBOM on YOUR sample-repo (optional if installed) ==='
if command -v syft >/dev/null; then syft packages "$DEVSEC_REPO" -o cyclonedx-json > "$DEVSEC_SBOM/sbom.cyclonedx.json" 2>&1 && head -20 "$DEVSEC_SBOM/sbom.cyclonedx.json"; else echo 'syft not installed — writing checklist instead'; fi
cat > "$DEVSEC_SBOM/checklist.md" <<'EOF'
# SBOM Checklist — YOUR lab repo
- [ ] Identify artifact: sample-repo + container/Dockerfile
- [ ] Generate SBOM: syft packages $DEVSEC_REPO -o cyclonedx-json
- [ ] Or: syft packages container/ -o spdx-json
- [ ] Store SBOM with release tag / build ID
- [ ] On CVE alert: map affected package via SBOM → patch → rebuild
- [ ] Verify SBOM signature / provenance (SLSA literacy — optional)
NEVER: generate SBOM from stranger repos without authorization
EOFCommand — copy this
grep -E '\[ \]|syft|NEVER' "$DEVSEC_SBOM/checklist.md"
Primary tools to practice this lesson: syft, grep. Reference sites: Syft (https://github.com/anchore/syft); CISA SBOM (https://www.cisa.gov/sbom); NIST SSDF (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Correlation discipline
SBOM components cross-reference Module 7 Trivy findings — same image thread.
Provenance stub documents build pipeline ID on lab stub — not silent unknown.
3. Refused
No forged SBOMs; no stranger org artifact SBOM claims; no malicious dependency guides.
SBOM literacy supports transparency — not supply chain theater.
4. What you ship: SBOM card
Format + five components + provenance stub + vuln correlation + NEVER forged SBOM line.
5. What you record before the next lesson
SBOM card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish fabricated SBOM for stranger org product claiming 'supply chain audit' without authorization.
Right
SBOM card from `$DEVSEC_LAB` lab artifact. Next: Dependency Risk.
Mission: SBOM card
1) Name five SBOM literacy rows. 2) Five components from lab build. 3) Provenance stub and vuln correlation. 4) Write NEVER forged SBOM line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SPDX vs CycloneDX — literacy pick stub?”
Knowledge Check
APPLY: SBOM literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Fabricated SBOMs for stranger products are lab.
True or False
Knowledge Check
APPLY: SBOM card includes:
Multiple choice