Policy-Driven SBOM Verification at Build Time: Enforcing Supply Chain Attestation Standards Without Disrupting Software Delivery Cadence

Abstract

Modern software delivery pipelines have grown in complexity and size due to the growing number of open-source components, introducing an attack surface that has compelled software bill of materials (SBOM) and other transparency mechanisms to be mandated by regulators and standards bodies. This paper draws upon empirical, regulatory, and systems-security research published through the end of 2023 to explore the possibilities for policy-driven SBOM verification that can be integrated directly into continuous integration and continuous delivery (CI/CD) build pipelines without adversely affecting release timelines. The paper highlights persistent challenges in SBOM adoption, such as the immaturity of the tools, fragmentation of the formats, and analysis overhead, based on taxonomic analyses that cataloged 107 unique attack vectors that are currently open source, tied to 94 documented attacks, and 33 documented mitigating safeguards, along with mixed-methods studies with practitioners, consisting of 17 interviewees and 65 survey respondents from 15 countries. It also summarizes and compares cryptographic attestation solutions, such as in-toto and Sigstore, and places them in the context of complementary policy solutions like the National Institute of Standards and Technology Secure Software Development Framework and Executive Order 14028. Proposed in this paper is a comparative framework and formal compliance measure to reconcile automated policy gates with delivery velocity. Data synthesized from the literature on quantitative highlights include that open-source supply chain attacks reported in 2021 grew by 650%, 2,818 of the maintainer email domains were found to be expired, resulting in 8,494 npm packages being exposed to hijacking, and 42 distinct secure-development tasks were organized across four practice groups in NIST SP 800-218. The synthesis leads to a conclusion that build-time policy enforcement, applied as an incremental, cacheable, and risk-tiered policy gate instead of a single, all-encompassing checkpoint, is a viable way to attain transparency through attestation without compromising delivery throughput.