Lab: Secure the pipeline: secrets, vulnerabilities, SBOM and signing

What you will learn in this TP

• Detect secrets and vulnerabilities
• Produce an SBOM
• Sign and verify an image

Introduction #

What you will learn in this section

• Detect secrets and vulnerabilities
• Produce an SBOM
• Sign and verify an image

Context. An audit reveals that no security check is automated. You add the essential DevSecOps checks to the delivery chain, locally first, then in the pipeline.

Prerequisites: Docker and Git installed on your machine  ·  Estimated time: 50 min

An image that is scanned, inventoried and signed, and a pipeline that blocks critical risks.

Hands-on #

Guided steps, with their solution.

1. 1. Detect a committed secret

   Why? A secret in Git history remains usable even after the file is deleted.

   Create a repository, commit then delete a file containing a fake AWS key, and scan the history with Gitleaks.

2. 2. Scan dependencies

   Why? Most vulnerabilities come from libraries, not from the team's own code.

   Declare an old dependency in requirements.txt and scan the project with Trivy in filesystem mode, failing on HIGH and CRITICAL.

3. 3. Build and scan the image

   Why? The image also ships base system packages, often the first source of CVEs.

   Start a local registry, build a minimal image, push it and scan it with Trivy.

4. 4. Produce an SBOM

   Why? The SBOM answers "are we affected by this new vulnerability?" in minutes.

   Generate the image's SPDX SBOM with Syft, look up the requests version it contains, then scan the SBOM with Trivy.

5. 5. Sign and verify the image

   Why? The signature proves the image comes from your pipeline and was not modified; sign the digest, never a tag.

   Generate a Cosign key pair, sign the image by digest (local registry, no transparency log), verify the signature, then show another image cannot be verified.

6. 6. Add to the pipeline

   Why? Checks are only valuable if they run on every change.

   Add a security job (Gitleaks, Trivy) to the GitHub Actions workflow from the CI/CD lab and, after publishing, the SBOM and a keyless signature (OIDC). Then clean up the local registry.

Difficulty level : ●●●○○ (3/5)