Supply chain security has a lot of vocabulary and a small number of things that actually matter. Here's what to implement first, and why.
The supply chain conversation drowns in acronyms, which lets teams conclude it is a large programme and defer it. In practice the first useful increment is a few pipeline steps, and it pays for itself the first time a widely-exploited CVE lands.
Start with the SBOM
Generate a bill of materials at build time and store it with the image. The value is not compliance — it is that when the next critical vulnerability drops, answering 'are we affected, and where' becomes a query instead of an archaeology project. Teams without SBOMs spend that first day guessing.
Then sign, then attest
- Sign images at build time; keyless signing removes the key-management problem that stalls most rollouts
- Generate provenance describing what built the artefact, from which source commit, on which system
- Verify signatures at admission — an unenforced signature is a decoration
- Fail the build on new critical vulnerabilities, and track the ones you accept with an explicit expiry date
Sequencing matters
Do not turn on admission enforcement first. You will block deployments on day one, lose the room, and the initiative will be quietly shelved. Generate and record for a few weeks, get the signal clean, then enforce. Regulatory deadlines are pushing this up the roadmap for anyone selling into the EU — better to arrive there deliberately than in a panic.