Software Supply Chain Security
Learn to prove what is inside your software and where it came from. SBOMs in SPDX and CycloneDX, PURL identifiers, SLSA build levels, Sigstore keyless signing with cosign and Rekor, dependency risk, risk-based prioritization with EPSS and CISA KEV, VEX exploitability statements, and the gates that make it all enforceable — remembered with spaced repetition.
- flashcards
- 113
- flashcards
- per day
- ~10 min
- per day
- level
- Intermediate → Advanced
- level
- modules
- 7
- modules
What is software supply chain security?
Software supply chain security is the practice of knowing — and being able to prove — what your software is made of and how it was produced. Most of what you ship is code nobody on your team wrote: a handful of direct dependencies expands into hundreds of transitive ones, layered on a base image, assembled by a build system that holds credentials for production. Each of those is a way in.
The discipline answers four separate questions with four different artifacts, and confusing them is the most common mistake. An SBOM says what is inside. Provenance says who built it and how — which a signature alone cannot tell you, as SolarWinds demonstrated when attackers produced perfectly signed malicious releases. VEX says which of the listed vulnerabilities actually matter. And prioritization signals — EPSS, CISA KEV, reachability — say which of those to fix first.
This track follows that chain end to end: SBOM formats and PURL identifiers, SLSA build levels and Sigstore keyless signing, dependency confusion and malicious packages, risk-based prioritization, VEX statuses, artifact integrity through digests rather than tags, and the pipeline gates and frameworks — NIST SSDF, EO 14028, the EU Cyber Resilience Act — that turn all of it into something enforced rather than documented. The regulation itself has its own track: the EU Cyber Resilience Act covers the obligations, deadlines and product classes in detail.
7 modules, seed to bloom
Each module is a set of flashcards — 113 in total. Answer, review, and watch your knowledge grow from seed to full bloom.
SBOM & Inventory
Software bills of materials — SPDX and CycloneDX, PURL identifiers, build-time generation and continuous monitoring
18 cardsSigning & Provenance
Proving who built an artifact and how — SLSA build levels, Sigstore keyless signing, Rekor and in-toto attestations
18 cardsDependency Risk
Transitive dependencies, reachability, malicious packages and the registry behaviours that let them in
16 cardsRisk Prioritization
Deciding what to fix first — CVSS, EPSS, CISA KEV, reachability and ASPM correlation across tools
16 cardsVEX & Exploitability
Telling consumers which listed vulnerabilities actually affect a product — VEX statuses, justifications and automation
15 cardsArtifact Integrity
Keeping a built artifact trustworthy — digests over tags, trusted registries, promotion instead of rebuilding
15 cardsGates & Frameworks
Enforcing supply-chain controls in the pipeline, and the frameworks that define what to enforce
15 cardsSample questions
A taste of the real flashcards. Pick an answer, then reveal the explanation.
What is a Software Bill of Materials (SBOM)?
- AA machine-readable inventory of the components in an artifact, their versions and relationships
- BA signed record of who built an artifact and which steps and inputs produced it
- CA ranked report of the known vulnerabilities affecting an application's dependencies
- DA policy document listing which open-source licenses a project is permitted to use
What does a Package URL (PURL) identify?
- AA software package across ecosystems, using type, namespace, name and version
- BA network location from which a package artifact can be downloaded directly
- CA vulnerability record assigned to a package by a national advisory database
- DA build job that produced a package, including its runner and commit hash
Which levels does the SLSA Build track define in the current specification?
- ABuild L0 through Build L3, where L0 means no guarantees are claimed at all
- BLevels 1 through 4, where Level 4 requires hermetic and reproducible builds
- CBronze, Silver and Gold tiers awarded after an external conformance audit
- DA single pass or fail verdict based on whether signed provenance is published
What does an EPSS score estimate?
- AThe probability that a vulnerability will be exploited in the wild in the near term
- BThe proportion of an organisation's assets that run the affected component version
- CThe severity of the impact should an attacker successfully exploit the vulnerability
- DThe time a typical engineering team needs to remediate the vulnerability fully
Which set of statuses does a VEX statement use?
- ANot affected, affected, fixed, and under investigation
- BOpen, in progress, resolved, and closed without action
- CCritical, high, medium, and low by technical severity
- DReachable, unreachable, unknown, and not applicable
Learn it once, keep it for good
Answer a question
Each card is one practical concept with multiple options. Pick what you think is right.
Get the full answer
See the correct option plus a clear explanation, and a link to deeper docs when one is available.
Review at the right time
A spaced-repetition engine (SM-2 or FSRS) resurfaces each card just before you would forget it.
Why supply chain security is worth your time
The questions regulators now ask
EO 14028 and the EU Cyber Resilience Act turned SBOMs and vulnerability handling from good practice into procurement and legal conditions.
Prioritize by exploitability, not severity
CVSS says how bad a flaw would be. EPSS, KEV and reachability say whether it can be exploited at all — the difference between a fixable backlog and an endless one.
Verified against primary sources
SLSA levels come from slsa.dev, EPSS and KEV from FIRST.org and CISA — not from secondary summaries, several of which are out of date.
Mechanics, not slogans
What cosign signs, what Rekor records, what a PURL namespace is, why a tag is not a digest — the details you need to actually implement this.
Common questions
What is an SBOM? +
A Software Bill of Materials is a machine-readable inventory of the components in an artifact — their versions and, crucially, their dependency relationships. The two dominant formats are SPDX and CycloneDX. Without relationships an SBOM cannot tell a direct dependency from a deep transitive one, which is what makes it actionable during an incident.
How many SLSA levels are there? +
The SLSA Build track defines L0 through L3 in the current specification: L0 claims nothing, L1 requires provenance to exist, L2 requires it to be signed by a hosted build platform, and L3 requires that platform to be hardened so provenance cannot be forged. The older four-level scheme with a hermetic Level 4 comes from the retired v0.1 draft and still circulates widely — check slsa.dev rather than a secondary source.
What is the difference between an SBOM and SLSA provenance? +
An SBOM says what is in an artifact; SLSA provenance says who built it, from which source, and how. They answer different questions and neither substitutes for the other — an SBOM cannot detect a compromised build, and provenance cannot tell you which library to patch.
What is EPSS and how is it different from CVSS? +
CVSS scores the intrinsic technical severity of a flaw. EPSS estimates the probability it will actually be exploited in the wild, and is re-scored daily. Prioritizing by CVSS alone means chasing theoretical criticals while an actively exploited medium sits untouched — which is why CISA KEV, listing vulnerabilities confirmed to be exploited, outranks both.
What is VEX used for? +
VEX lets a supplier state whether a vulnerability listed in their SBOM actually affects the product, using four statuses: not affected, affected, fixed, and under investigation. It exists because publishing an inventory without it means every disclosed CVE alarms every consumer, most of the time wrongly.
Is it free? +
Yes, completely free. No registration or credit card is required, and all your progress is stored locally in your browser.
Ready to prove what you ship?
Plant your first seed today. Ten minutes a day turns SBOM, SLSA and VEX from acronyms into controls you can implement.