Verification · Supply chain · SBOM and provenance
SBOM generation
Emit an SPDX or CycloneDX bill of materials per release.
How to build it
- Run syft against the release artifact or container image in the release workflow.
- Emit the bill of materials as SPDX or CycloneDX JSON.
- Upload the SBOM as a release asset next to the artifact.
Signals in a repository
- A syft step in a release workflow or an anchore/sbom-action usage.
- *.sbom.json or *.spdx.json files attached to releases.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.