Why it exists
A container image needs evidence about what it includes and whether the artifact being verified is the one that was built.
Portfolio / CASE STUDY
Private security lab
Supply Chain Security Lab.
A reproducible container security lab that builds, scans, inventories, and signs a small Go service.
MY ROLE
Independent container security and verification
What I built
I used a minimal Go service to compare an intentionally noisy baseline with a hardened image, generate a software bill of materials, and verify a signature against the saved artifact.
Project in view
Engineering decisions
Compare like for like
The lab records the scanner version and database for its baseline and hardened scans so the reported difference has context.
Inventory the artifact
A CycloneDX SBOM captures what the scanner identified in the built image for later inspection.
Verify the saved artifact offline
The signing workflow ties verification to the saved artifact and checks it after the local registry is stopped.
Capabilities in practice
- Container hardening
- Vulnerability triage
- SBOM generation
- Artifact signing and verification
Status & scope
Private lab on a small service and recorded scanner database. Results are specific to the artifacts and configuration that were tested.
Private repository supply-chain-security-lab