Skip to main content
TT
Lab
Learn
Sandbox
Community
Language Learning (in Korean)
Get started
Learn
Learning paths
Courses
The Build Was Green — So Who Put That Library In?
Prove an artifact with its inventory, signature and provenance
중급 · Lessons 14 · Lab 4
Start the lab
Curriculum
We picked seven; twenty-five got installed
We picked seven; twenty-five got installed
reading
Count all twenty-five by hand and write them as an SBOM
lab
Quiz: counting what is actually inside
quiz
Six red lines — which one can you fix today?
Six red lines — which one can you fix today?
reading
Get the boundaries right and keep only today's fixes
lab
Quiz: matching the inventory against advisories
quiz
The signature is fine — but we revoked that key
The signature is fine — but we revoked that key
reading
Build the four cases where verification must fail
lab
Quiz: signing and verification
quiz
Nobody knows where these bytes came from
Nobody knows where these bytes came from
reading
Quiz: provenance
quiz
No evidence, no deploy
No evidence, no deploy
reading
The signature checks out, but we never allowed that builder
lab
Quiz: the release gate
quiz
Reference docs
SLSA — 보안 레벨(Build 트랙)
SLSA — Provenance v1 술어
sigstore — cosign 서명 개요
CycloneDX — 규격 개요
SPDX 2.3 — 꾸러미 정보
OSV — 취약점 자료 스키마