# Software Supply Chain Security

> Master the defense of the software supply chain. Learn to implement SBOMs, cryptographic artifact signing, and the SLSA framework.

Canonical: https://codelivly.com/learning-paths/software-supply-chain-security
Last updated: 2026-10-30

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 25 |
| Estimated time | 2 h 30 min |

This advanced learning path covers the end-to-end security of the software delivery lifecycle. You will learn how to generate and analyze Software Bill of Materials (SBOMs), implement cryptographic artifact signing using modern tools like Sigstore and Cosign, understand and apply the SLSA (Supply-chain Levels for Software Artifacts) framework, and secure third-party dependencies against tampering. The path culminates in a hands-on guided lab where you will generate an SBOM, sign a container image, and verify its cryptographic provenance to ensure tamper-evident software delivery.

## Rooms in this path

1. [Supply Chain Attack Landscape](https://codelivly.com/rooms/supply-chain-attack-landscape) - Master the threat landscape of software supply chain attacks. Learn to identify, analyze, and mitigate risks from…
2. [Software Bill of Materials (SBOM)](https://codelivly.com/rooms/software-bill-of-materials-sbom) - Master SBOM generation and analysis. Learn to map dependencies, enforce compliance, and integrate SBOMs into the CI/CD…
3. [Artifact Signing with Sigstore](https://codelivly.com/rooms/artifact-signing-with-sigstore) - Master cryptographic artifact signing using Sigstore and Cosign.
4. [SLSA and Build Provenance](https://codelivly.com/rooms/slsa-and-build-provenance) - Master the SLSA framework and build provenance. Learn to generate, verify, and enforce cryptographic attestations for…
5. [Dependency Governance and Private Registries](https://codelivly.com/rooms/dependency-governance-and-private-registries) - Master dependency governance and private registries. Learn to proxy, cache, and secure third-party packages to prevent…

## Related

- [Career path: DevSecOps Engineer](https://codelivly.com/career-paths/devsecops-engineer)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)
- [Infrastructure as Code Security](https://codelivly.com/learning-paths/infrastructure-as-code-security)