Um estudo sobre a aplicação de ferramentas para a proteção de cadeias de suprimento de software

Abstract

This work presents a study on the application of tools for the protection of software supply chains, culminating in the development of a continuous integration (CI) pipeline. Using tools such as Trivy, Syft, Snyk, and Cosign, the developed pipeline enables the automatic generation and analysis of the Software Bill of Materials (SBOM), as well as the identification of vulnerabilities in artifacts and the application of digital signatures to ensure artifact integrity. The approach involved the study of basic security concepts, experimentation with tools, and iterative pipeline implementation. The research resulted in an effective solution for mitigating vulnerabilities and contributing to artifact traceability and security, thus adhering to the principles of Supply Chain Levels for Software Artifacts (SLSA). It is concluded that the proposed approach significantly contributes to the protection of the software supply chain, offering a secure and reliable process for the construction and deployment of systems.