The main practical attack vector of recent years is not your code.
The two acronyms in the title answer different questions. An SBOM is an inventory of what an artifact is built from: packages, versions, hashes. It exists not for compliance paperwork but so that “does this CVE affect us?” is answered in minutes by a machine query rather than in a week of polling teams. SLSA is a tiered scale of requirements on how the artifact came to be, not on what the code does. Its Build track asks that the build run from a versioned source, on an isolated runner, with signed provenance stating “this binary was built from this commit by this pipeline”; since v1.2 a Source track adds requirements on how that source is authored, reviewed and managed. In short: the SBOM says what is inside; SLSA says whether you can trust how it was written and built. Pinning is a precondition for both: without it, the inventory does not describe what ships to prod tomorrow (83).
# Cargo.lock is committed + cargo-deny in CI
[bans]
deny = [{ name = "openssl" }] # policy: rustls only
[advisories]
vulnerability = "deny"// go.sum: cryptographic hashes of all dependencies; public modules
// are additionally checked against the checksum database (sum.golang.org).
//
// GOPRIVATE=git.example.com/* — private prefixes bypass the proxy and checksum DB
// GONOSUMDB / GONOSUMCHECK — narrower settings, and NOT a hardening:
// they DISABLE verification, not enable it
//
// govulncheck in CI: call-graph analysis, alerts only on actually reachable vulnerabilities# lock is committed; floating versions are banned; an SBOM for every release
uv lock --check # CI fails if the lock has drifted from pyproject.toml
uv sync --frozen # install exactly what the lock says, no re-resolution
syft dir:. -o spdx-json > sbom.json# verification-metadata.xml pins the hashes of all build artifacts
./gradlew --write-verification-metadata sha256 help # generate it
./gradlew build # fails if a dependency hash does not match
# Maven: same idea via dependency locking and the repository's checksum policy