[Verse 1]
Every build starts naked, no history, no name,
Syft walks the binary, writing down its claim—
a list of every package, every library it holds,
that's the SBOM, the manifest, the story fully told.
Grype comes scanning, hunting vulnerable seams,
Trivy double-checks it, chasing shadow CVEs,
CycloneDX or SPDX — two dialects, one truth,
pick the format your tools speak, that's the honest proof.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 2]
Climb the SLSA ladder, level by level rise,
one is just a record, four's a fortress in disguise.
Cosign seals the binary, no password, just a key,
Sigstore logs it public, so the whole world sees.
Build it twice, same bytes both times, that's reproducible,
no hidden compiler mood swings, nothing's miscible.
Provenance — the paper trail of where a thing was born,
without it every artifact's an orphan, lost, forlorn.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 3]
Vault or SOPS locks your tokens, cipher in a drawer,
never paste a password where the logs can keep the score.
Least-privilege runners, only touch what they must do,
one narrow door per pipeline, nothing leaking through.
Ephemeral machines — they're born and burn away,
spin up for the job, then vanish, none left to betray.
No lingering root shell, no forgotten cache,
every build's a fresh page, never one repeated crash.
[Bridge]
Take Betaflight's firmware, or a Zephyr sample spark,
wire a pipeline onto it before the range goes dark.
Every single commit: Syft scans, cosign seals,
push a signed binary, an SBOM that reveals
what's inside the flight controller, nothing left to hide,
drone-war cadence tells us: verify, don't just abide.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 4]
Dependabot whispers when a patch comes due,
Renovate keeps the lockfile honest, nothing slips askew.
Policy gates at the border, admission-control eyes,
a signature missing means the deploy never flies.
Diff the SBOMs release to release, watch what changed,
a new transitive stranger means the graph gets rearranged.
Attestations stack like ledger pages, one on one,
every hop from source to runtime traceable, none undone.
Audit the audit, question the trust you've built,
supply chains rust in silence when the checking's ever spilt.
Rotate the keys before they age, revoke what shouldn't stay,
hygiene isn't one-and-done — it's practiced every day.
[Outro]
SBOM, SLSA, cosign, ephemeral and clean—
that's supply-chain hygiene.
Довіряй, але перевіряй,
build it so.