SBOM and Provenance: Knowing What You Ship

Why this matters

A critical vulnerability lands in a ubiquitous library and the question is immediate: where do we ship it. Teams without SBOMs answer by searching repos by hand for a week; teams with them query the inventory in minutes. The difference is not tooling budget, it is the habit of generating the list at build time and storing it with the artifact. The L58 lab builds an SBOM for a small artifact and prioritizes its fixture findings; this lesson explains what the list means and what it cannot do.

Concepts

An SBOM names components: libraries, versions, licenses, relationships. Generate it at build from the actual resolved dependencies (lock files, build attestations), never by scanning afterward and hoping the scan sees what the build used. Store it with the artifact, versioned together; an SBOM that drifts from its artifact is a second fiction to maintain.

Provenance answers the harder question: who built this, from what source, with which steps. Signed attestations bind the artifact to its build (source commit, build configuration, materials), and verification checks the binding before deploy. Unsigned artifacts carry claims, not evidence; policy decides which sources require provenance, and the requirement lands in admission (lesson 3), not in documentation.

Prioritization beats counting. Findings rank by severity adjusted for reachability: a critical in an unreachable test dependency waits, a high in the request path ships now. Fixture findings in labs are labeled fixtures and prioritized as practice; the skill transfers, the verdicts do not. Track mean time to fix per severity band, not raw counts, or the program optimizes for closing tickets instead of reducing exposure.

Worked example

A small fixture artifact gets an SBOM at build time; the learner reads it (components, versions, licenses) and triages ten fixture findings down to two that are reachable and severe. Provenance is generated and verified for the artifact, then a tampered copy fails verification with the mismatch quoted. List, prioritize, verify: the three motions in one sitting.

Common wrong move

Generating SBOMs and filing them unread. An inventory nobody queries during incidents is compliance theater; the value arrives when the vulnerability lands and the answer takes minutes. Query in drills, or the list rots.