sbom-slsa

To generate CycloneDX SBOMs and SLSA provenance, run the process during close-phase builds or on pre-publish release candidates. It enumerates dependencies, generates the attestations, signs them, and attaches the artifacts to your releases.

You need SLSA provenance attestations when shipping code-emitting projects to ensure verifiable build integrity. Generating them during close-phase builds or pre-publish release stages provides verifiable proof of how your artifacts were constructed.

Yes, you can sign and verify SBOMs before publishing a release candidate. The process generates CycloneDX SBOMs and SLSA provenance, signs them for verifiability, verifies their integrity, and then attaches them to the release.

The best way to automate CycloneDX SBOM generation is to run the sbom-slsa process during close-phase builds. It automatically enumerates your project dependencies, generates the CycloneDX SBOM files, and attaches them to your release artifacts.

Yes, sbom-slsa records provenance generation events for audits through ADR logging. This ensures that every time CycloneDX SBOMs and SLSA provenance are generated and signed, the event is logged for compliance tracking.

In build management, a CycloneDX SBOM enumerates the composition and dependencies of your artifacts, while SLSA provenance verifies the build's origin and integrity. This process generates both and pairs them to provide complete artifact verifiability.