Hye-won L.
Sample Real incidents made it concrete
Connecting each defence to an actual incident pattern made the reasons behind every step easy to explain to my team.
Software supply chain security: dependencies, SBOMs, signing
Protect what goes into your software and how it is built: dependency hygiene, SBOMs, provenance, signing with Sigstore and hardened CI pipelines
Created by Amara Nwosu
- Updated October 2026
- English
- Intermediate
What you will learn
- Map a software supply chain and identify its riskiest links
- Manage dependencies with lock files, pinning and automated updates
- Generate and use SBOMs to answer exposure questions quickly
- Produce build provenance and explain SLSA levels
- Sign and verify container images and artifacts with cosign
- Harden CI pipelines and respond to a compromised dependency
Course content
Understanding the supply chain
Hardening the build
- Video: Pinning CI actions and tools 10 min
- Video: Least privilege for pipeline tokens 9 min
- Article: Ephemeral, isolated runners 9 min
- Video: Reproducible and hermetic builds 9 min
Provenance and signing
- Video: Build provenance and SLSA 10 min
- Article: Signing images with Sigstore and cosign 11 min
- Video: Attaching SBOMs and attestations 9 min
- Video: Verifying before deployment 10 min
Registries and distribution
- Article: Private registries and proxies 9 min
- Video: Protecting publishing credentials 9 min
- Video: Base images and image freshness 9 min
Developer machines and tools
- Article: Securing developer workstations 9 min
- Video: Editor extensions and local tooling 8 min
- Video: AI coding assistants and invented packages 9 min
Response and programme
- Article: When a dependency is compromised 11 min
- Video: Monitoring for supply chain signals 9 min
- Video: Vendor and open source risk 8 min
- Article: Building a supply chain roadmap 8 min
- Quiz: Final check 6 min
Requirements
- Experience building and deploying software with a package manager
- Basic familiarity with containers and CI pipelines
- A GitHub account for the hands on exercises
Description
Modern applications are mostly made of other people's code: open source packages, base images, build tools and CI actions. Attackers have noticed. Compromised packages, malicious look alike names, hijacked maintainer accounts and tampered build steps have all caused serious incidents in recent years, including the backdoor discovered in the xz utilities in 2024 and the compromise of a popular GitHub Action in 2025.
This course teaches developers and platform engineers to defend the whole path from source to production.
What you will learn
- Mapping your software supply chain and its weak points
- Dependency hygiene: lock files, pinning, update automation and choosing packages carefully
- Software bills of materials (SBOMs) in CycloneDX and SPDX formats, and how to use them
- Build provenance and the SLSA framework
- Signing and verifying artifacts with Sigstore and cosign
- Hardening CI pipelines and protecting the repositories and registries they depend on
- Responding when a dependency you use is compromised
How the course works
We secure a sample service built in Node.js and Python and shipped as a container image through GitHub Actions. Each section adds one defence and verifies it works. By the end, the image carries an SBOM, a signature and provenance, and the deployment refuses anything that does not verify.
Who this course is for
- Developers responsible for dependencies and builds
- Platform and DevOps engineers who run CI and registries
- Security engineers starting a supply chain programme
Instructor
Amara Nwosu
Security operations engineer teaching incident response and software supply chain security
- 4.3 instructor rating
- 13 reviews
- 3,740 students
- 2 courses
- Sample
I work in security operations: building detections, running incident response and helping engineering teams secure the way they build and ship software.
My courses focus on the defender's side of the table. We look at how incidents unfold, which logs and signals reveal them early, how to contain damage calmly and how to recover without losing evidence. On the engineering side, I teach dependency hygiene, SBOMs, signing and build pipelines that are hard to tamper with.
I like checklists, runbooks and tabletop exercises, because preparation is what makes the difference when something goes wrong at three in the morning. Every course ends with templates you can adapt for your own team.
Student reviews
Victor H.
Sample Clear path from basics to signing
The order of the course matches what a real team can adopt: hygiene first, signing later. Very practical.
Ngozi E.
Sample Tabletop exercise was excellent
Running the compromised package scenario showed us how long finding affected services would really take. We started generating SBOMs the next week.
Dominik S.
Sample Good cosign walkthrough
Keyless signing and verifying by identity was explained well. Admission policy setup needed some extra reading.
Aiyana T.
Sample Useful for platform teams
Pinning actions and least privilege tokens were quick wins across all our repositories.
Bruno C.
Sample Solid, GitHub focused
Accurate content, but most pipeline examples use GitHub Actions. GitLab users will need to translate.
Keep exploring
All Secure Development courses
More in Secure Development
$59.99
Enroll now