Web › Module 3 › Lesson 2
SBOM Pinning and Trust Boundaries
A03: SBOM + sha256 pins;.
Visual · sbom_pinning
SBOM and pinning: with curl -I. Hash YOUR inventory — never hydra the LAN.
Opening
If you cannot name what you shipped, you cannot tell when it was poisoned.
A Software Bill of Materials (SBOM) lists components and versions in an artifact. Lockfiles and pins freeze what install resolves. Trust boundaries mark where your control ends: public registry, vendor CDN, CI runners, base images. OWASP Top 10:2025 A03 cares because untracked, floating dependencies make compromise invisible. This is ORIGINAL Cyberlium teaching.
1. SBOM: inventory as a security control
SBOM formats (named literacy: CycloneDX, SPDX) answer “what is inside?” after a CVE drops. Without inventory, you guess. Attacker goal after a compromise: remain unnamed in your blind spot. Defender goal: generate and store SBOMs for releases YOU produce. This lesson’s artifact is a simple human-readable inventory — enough to learn the habit without claiming tool certification.
2. Pinning and lockfiles: reproducibility beats “latest”
Pins (=1.2.3) and lockfiles record exact resolved trees. Floating ranges (^, latest tags) can pull a compromised publish between builds. Shipping: commit lockfiles; review lockfile diffs in PRs; rebuild from known pins. Do not confuse pinning with “never update” — update deliberately with review.
3. Trust boundaries: registry, CI, artifact store
You trust the registry to serve the bytes for a name+version. You trust CI to build without secret theft. You trust the artifact store not to swap binaries. Break any boundary and A03 bites. Controls: checksum verification when vendors publish digests; signed releases when available; least-privilege CI tokens; protected branches. Do not practice by breaking someone else’s CI.
4. What you practice on files you own
168.0.1/ — if router, STOP. Create a toy sbom-lite.txt listing package, version, source. Hash the file (SHA-256) so you feel integrity of YOUR inventory document. Store under cyberlium-lab chmod 600. That pairs Topic 8 hashing habits with A03.
5. What you record
Date (UTC). Identify banner. SBOM purpose. Pin vs floating. Trust boundary list. sbom_sha256. Ethics: NEVER poison CI/repos; NEVER hydra/nmap the LAN. Path: $HOME/cyberlium-lab/a03-sbom-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.
6. Wrong vs right: pipeline attacks vs pin+inventory habit
Worked failure — same word “SBOM,” opposite action. Right never needs to sabotage a build.
Wrong
Inject malicious steps into a classmate CI. Hydra 192.168.0.1. Delete lockfiles “for speed.” Steal registry tokens as a lab.
Right
Identify DEMO; write sbom-lite + sha256 for a toy you own; lock a03-sbom-notes.txt. Next: Compromised Package Stories Concepts.
Author the toy SBOM, hash it, identify DEMO. Hash optional but recommended — this lesson requires it.
Command guide
A03 Supply chain — Pinning and lockfiles
═══ COMMANDS ═══
Command — copy this
test -f package-lock.json && echo "found package-lock.json" test -f requirements.txt && echo "found requirements.txt" ls -la package-lock.json requirements.txt poetry.lock go.sum Cargo.lock
Mission: a03-sbom-notes.txt in cyberlium-lab (mode 600)
1) curl -sS -I http://192.168.0.1/ —2) Author sbom-lite.txt with pinned toy components; record SHA-256. 3) Fill $HOME/cyberlium-lab/a03-sbom-notes.txt, chmod 600. No CI poisoning.
Stuck? Ask Cyberlium AI Mentor
If “SBOM only matters after I breach a build” still feels true, ask for a hint — not a CI exploit. Try: "Hint only: why inventory+pins reduce A03 risk, how sha256sum proves YOUR file, and where locked a03-sbom-notes.txt lives?"
You now treat SBOM and pinning as A03 defender controls with clear trust boundaries — on artifacts you own, identified demo, locked notes. Original Cyberlium — not official OWASP certification. Next — Compromised Package Stories Concepts.
Knowledge Check
APPLY: A CVE hits a transitive package and you have no inventory. What failed under A03 literacy?
Multiple choice
Knowledge Check
APPLY: True or False: Floating latest tags in production builds are equivalent to pinned lockfiles for supply-chain risk.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is a TP-Link router login. What do you do?
Multiple choice