Technique · Supply chain

SBOM and provenance

Records what went into a build and signs it, so consumers can verify where an artifact came from and what it contains.

Sub-techniques

SBOM generation V1017.001

Emit an SPDX or CycloneDX bill of materials per release.
Signing and attestation V1017.002

Sign artifacts and attach build provenance (SLSA).