Build a third-party inventory

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R36 — Syft/Grype SBOM

   R37 — SLSA

   R43 — OpenSSF Scorecard

   R44 — OWASP SCVS component verification

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build a comprehensive Third-Party AI & Software Supplier Inventory across P1–P3: model providers, Hugging Face repos, embedding/reranking models, MCP servers, Python packages, container base images, and datasets.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Record data-egress boundaries, training-on-customer-data policies, pinning status, and fallback options for every third-party dependency using D12.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Master Third-Party AI Supplier Inventory & Risk Register.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R36Syft, Grype & Trivy (SBOM)↗ anchore.com

  CycloneDX/SPDX SBOM generation, container image scanning, dependency vulnerability detection, and scanner limits.

• R37SLSA & Sigstore↗ slsa.dev

  Supply-chain Levels for Software Artifacts (SLSA), build provenance attestations, and Cosign artifact signing.

• R43OpenSSF Scorecard↗ scorecard.dev

  Automated supply-chain checks: pinned dependencies, least-privilege CI tokens, branch protection, and signed releases.

• R44OWASP SCVS↗ owasp.org

  Software Component Verification Standard: component inventory, provenance, and supplier assurance practices.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsAnchore · Tool docs + guides
  SBOM: Software Bill of Materials

  The assigned reading for Syft, Grype, and Trivy, covering CycloneDX/SPDX output formats, image and filesystem scanning, and the scanner limits that matter when the SBOM becomes an audit artifact.

  R36checked 2026-11-11
• videoAnchore · 6 min
  Easy SBOM & Vuln Scanning with Syft & Grype (Getting Started Tutorial)

  Shows the two-step inventory-then-scan workflow end to end: Syft generates an SBOM from an image or directory, Grype matches that SBOM against vulnerability data, which is the generation pattern your supplier inventory needs.

  R36checked 2026-11-11
• videoSigstore · Demo walkthrough
  Sigstore demo with cosign

  A first-party demo of cosign signing and verification across OCI registries, showing keyless and keyed modes plus attestations — the artifact-signing half of the SLSA provenance story.

  R37checked 2026-11-11
• articleOWASP · Standard overview + levels
  OWASP Software Component Verification Standard

  SCVS gives you the verification levels and component-inventory/provenance/supplier-assurance requirements to structure the inventory itself, so each supplier row has a checkable control behind it.

  R44moved 2026-11-11
• labSachin Chaurasiya · ~35 min lab
  Generate an SBOM with Syft and Scan It with Grype

  A runnable lab that emits both CycloneDX and SPDX for a container image without a Docker socket, then gates with grype and pins the schema version — exactly the reproducible scan D12 needs.

  R36checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.