Awesome Reviewers

Verification · Supply chain

SBOM and provenance

Records what went into a build and signs it, so consumers can verify where an artifact came from and what it contains.

Sub-techniques

  • SBOM generation V1017.001

    Emit an SPDX or CycloneDX bill of materials per release.

  • Signing and attestation V1017.002

    Sign artifacts and attach build provenance (SLSA).

How to build it

  1. Generate an SBOM in the release workflow and publish it with the artifact.
  2. Sign with keyless signing from CI identity.
  3. Verify signatures in deployment.

Signals in a repository

  • Release workflows calling syft, cosign or actions/attest-build-provenance.
  • *.sbom.json or *.intoto.jsonl assets on releases.