Software Supply Chain Security with Singularity Cloud Services

Bills of materials or BOMs are nothing new, but they are new in the software industry. They have been part of many supply chains for decades. When you purchase a car or a pharmaceutical device, the manufacturer of those products maintains a list of materials/ingredients and their respective suppliers. With this information the manufacturers have better control of product quality, and are able to respond to defects that might impact public safety. And this is how it applies to securing software supply chains.

Advantages of including SBOM are numerous, to mention some:

• Container producers can use SBOMs to document the contents of their work, and leverage automation to address the security, licensing and operational concerns connected with the use of open source software.
• Consumers further down the supply chain can leverage SBOMs to gain insight into the software containers they rely on to proactively identify vulnerabilities and drive risk management processes.
• Both producers and consumers can ensure compliance with emerging software supply chain guidelines, for example the May 2021 Executive Order on Improving the Nation’s Cybersecurity.

In a previous post, we detailed how Anchore and Sylabs collaborated to bring SBOM support to the Singularity Image Format (SIF). In particular, Anchore’s Syft and Grype tools were extended to have native support for SIF. With this work, Singularity users are able to generate SBOMs from SIF images, and start the process of improving the security of their HPC software supply chains.

Now, Sylabs has made it easier than ever for HPC users to utilize SBOMs to improve the security of their workflows. The Remote Builder in Singularity Cloud Services (SCS) now automatically generates an SBOM and embeds it within the SIF image build artifacts created by the service. All of this is done without affecting container functionality. No changes are required to your definition files to have an SBOM automatically built by Remote Builder.

Let’s build a SIF image using the updated Remote Builder in SCS and validate the SBOM contained within. The steps below assume you already have a free SCS account and have configured the access token in Singularity to allow remote builds.

First, create a very simple definition file in which we add 2 common software components.

The build request can then be either submitted through the Singularity command-line or using the SCS web interface at https://cloud.sylabs.io.

Submit the remote build request using Singularity command-line:

List the headers of the SIF file:

Talking about security, questions arise:

• Are there any known vulnerabilities in the image?
• If there are known vulnerabilities, how severe are they?
• What actions should I take (if any) to improve the security of my image?

Ideally, a container image is free of vulnerabilities the moment it is built, but we must also consider the lifespan of that container. Will it be kept for future scientific endeavors, who will run it, and how may this affect the security of their environment? As new vulnerabilities are discovered, how can we check for them in our container image? SBOMs allow users to continuously scan for known vulnerabilities in their containers, and take action when appropriate.

Anchore’s grype is the perfect tool for directly scanning SIF images, here is an example on how to do that:

Now the questions can be answered:

• Are there any known vulnerabilities in the image?
• Yes, there is at least one critical vulnerability.
• If there are known vulnerabilities, how severe are they?
• There are vulnerabilities on 2 packages classified in a range from medium to critical.
• What actions should I take (if any) to improve the security of my image?
• There are many options to choose from, it is more of a strategy answer rather than a technical one. Perhaps we don’t actually require the vulnerable component(s), and can simply remove them from our image. Perhaps we can update them to a patched version, or substitute with an alternative. Or perhaps, the risk is acceptable, given our use case.

Conclusion

The automatic inclusion of an SBOM within the Remote Build capabilities of Singularity Container Services helps researchers and developers build more secure HPC workflows. We’re excited to bring this functionality to Singularity Enterprise customers in the near future. With this new functionality, Sylabs continues to make progress towards making the deployment of performance intensive workloads simple, and more secure.