Comment sécuriser la supply chain logicielle en 2026

#!/bin/bash

# Installation de Trivy (scanner open-source pour vulnérabilités)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.55.0

# Créer un projet Node.js exemple
mkdir supply-chain-demo && cd supply-chain-demo
npm init -y
npm install lodash express

# Générer SBOM et scanner
trivy fs . --format json --output trivy-deps.json --scanners vuln,license,malware
trivy sbom trivy-deps.json --format table

# Exemple de sortie critique si vulnérabilités hautes
# Afficher résumé
trivy fs . --format sarif --output results.sarif

name: SCA with Trivy

on: [push, pull_request]

permissions:
  contents: read
  id-token: write
  security-events: write

jobs:
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
      - name: Upload Trivy scan
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

FROM node:20-alpine AS base

# Installer deps sans cache pour reproductibilité
WORKDIR /app
COPY package*.json .
RUN --mount=type=cache,target=/root/.npm npm ci --only=production --no-optional

# Copier source
COPY . .

# Multi-stage pour runtime minimal
FROM base AS runner
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs
USER nextjs
EXPOSE 3000
CMD ["node", "server.js"]

# Labels SLSA
LABEL org.opencontainers.image.source=https://github.com/user/supply-chain-demo
LABEL org.opencontainers.image.licenses=MIT

#!/bin/bash

# Authentification GitHub Container Registry
echo $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

# Build et tag
IMAGE=ghcr.io/USERNAME/supply-chain-demo:v1
docker build -t $IMAGE .
docker push $IMAGE

# Générer clé Cosign (ou utiliser GitHub OIDC)
cosign generate-key-pair

# Signer avec clé privée
cosign sign -key cosign.key $IMAGE

# Attestation SLSA provenance
cosign attest --predicate-type https://slsa.dev/provenance/v1 $IMAGE

# Vérifier
cosign verify $IMAGE

name: Build and Sign SLSA L2

on: [push]

permissions:
  contents: read
  id-token: write
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/project-everest/kstool:slsa2-debian11
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: slsa-framework/slsa-github-generator/.github/actions/slsa-build-provenance@main
        with:
          provenance-name: 'supply-chain-demo'
          base64-provenance: false
      - name: Sign
        run: |
          cosign sign --yes ghcr.io/USERNAME/supply-chain-demo@${{ steps.slsa.outputs.artifact-digest }}

version: '3.8'
services:
  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: dtrack
      POSTGRES_USER: dtrack
      POSTGRES_PASSWORD: changeit
    volumes:
      - postgres:/var/lib/postgresql/data

  dependency-track:
    image: owasp/dependency-track:4.14.0
    ports:
      - "8081:8080"
    environment:
      ALPINE_CDN_MIRROR: http://dl-cdn.alpinelinux.org/alpine
    depends_on:
      - postgres
    volumes:
      - dtrack:/data

volumes:
  postgres:
  dtrack:

# Upload SBOM: curl -X POST http://localhost:8081/api/v1/bom -F autoCreate=true -F projectUuid=UUID -F bom=@trivy-deps.json