supply-chain-sbom-provenance

Generate SLSA build provenance by emitting attestations via keyless signing with your CI OIDC identity. This verifies that container images were built from trusted sources and satisfies SLSA Level 3 requirements for artifact integrity.

Prevent dependency-confusion attacks by generating and validating CycloneDX or SPDX SBOMs to inventory all dependencies, and pinning container images to specific SHA256 digests to ensure only verified artifacts are deployed.

Comply with EO 14028 and EU CRA by enforcing rigorous artifact attestation, validating SBOMs, and applying keyless signing to verify artifact origin. This ensures transparent dependency tracking and protection against tampered builds.

Keyless signing with OIDC works by using your CI pipeline's identity to sign artifacts without managing private keys. It generates SLSA build provenance that confirms artifacts were built from trusted, authorized sources.

You need an SBOM for container deployments when you must provide a transparent inventory of direct and transitive dependencies to prove artifact integrity and protect against typosquats or unauthorized build processes.

You can validate CycloneDX or SPDX SBOMs before production deployment to ensure all dependencies are verified. This policy enforcement blocks tampered dependencies and ensures only signed, attested container images are released.