Building CIS-Hardened, SBOM-Attested CentOS 9 Golden Images with Packer, QEMU and PingAccess - entirely on WSL2

Short summary

Build CIS-hardened CentOS 9 golden images entirely on WSL2 using Packer and Ansible, with SBOM and signed VEX attestations for accurate vulnerability reporting. The guide addresses WSL2-specific networking, CIS partition layouts, and step-by-step Ansible roles to distinguish exploitable CVEs from theoretical vulnerabilities. Directly reusable for DevOps teams building auditable, hardened VM images without cloud infrastructure.

• •Two-stage Packer pipeline: CIS hardening via ansible-lockdown role, then app layer (Java 17 + PingAccess 8.3.5)
• •SBOM generated inside each VM via syft, merged with OpenVEX statements, and signed with cosign for attestation
• •Trivy scan within the pipeline shows suppressed CVE findings with VEX explanations; all artifacts embedded in image

Generated with AI, which can make mistakes.