Lesson 5.31: SBOMs and vulnerability matching
You can't patch what you don't know you ship. A software bill of materials (SBOM) lists every package inside an image, including libraries buried in Java archives that no package manager knows about. Matching that list against vulnerability data tells you what's exposed, and a build gate keeps it from shipping again. In the lab you generate an SBOM for an internal reports service with syft, match it with grype, find an old Log4j inside, turn the result into a CI gate and confirm the fixed build passes.
17 min
You will learn to
- Explain what an SBOM is and why images need one
- Generate an SBOM with syft (table and CycloneDX)
- Match an SBOM against vulnerabilities with grype
- Use --fail-on as a build gate
- Verify a fixed build
Key terms
- SBOM
- Software bill of materials: a machine-readable list of every component in a piece of software.
- CycloneDX, SPDX
- The two standard SBOM formats.
- syft
- Generates SBOMs from images, directories and archives.
- grype
- Matches packages from an image or SBOM against vulnerability data.
- GHSA
- GitHub Security Advisory ID; often shown for language packages, linked to a CVE.
- Build gate
- A CI step that fails the build when a check fails.
← Hash sweeps against allow-lists and IOCs · All lessons · Capstone: from a phishing e-mail to a contained infection →