Securing the Software Supply Chain: Generating SBOMs & SLSA Provenance in GitLab CI/CD

The rise of software supply chain attacks, like the SolarWinds breach and XZ Utils backdoor, has forced organizations to prioritize security beyond just their own code. Regulators, buyers, and frameworks such as NIST SP 800-218, Executive Order 14028, and FedRAMP now require creating Software Bill of Materials (SBOMs) and using SLSA (Supply-chain Levels for Software Artifacts) for provenance.

GitLab simplifies this compliance by offering native support for generating CycloneDX SBOMs in JSON format and automated SLSA provenance attestations. The process begins with a secure git push that includes a signed commit. The CI/CD runner then compiles binaries or containers while generating the dependency SBOM in CycloneDX JSON. This SBOM is automatically parsed by GitLab and added to the project's Security & Compliance > Dependency List dashboard, enabling cross-referencing with the GitLab Advisory Database.

For SLSA Level 2 build provenance, GitLab creates an in-toto attestation statement that includes the exact git commit SHA, repository URL, runner environment details, and the binary artifact's SHA-256 hash. Signing container images is streamlined with Cosign, using GitLab's OIDC JWT tokens to manage keys securely. This process ensures that consumers can verify both the container image and its attached SBOM, enhancing trust in the software supply chain.