Build verifiable artifacts
Create an SBOM
Generate a software bill of materials for each release so components, versions, relationships, and vulnerability impact can be queried later.
8 minute lesson
An SBOM is an inventory, not a certificate that software is safe. It helps answer what a release contains.
Generate it from the final build or resolved graph in a standard format such as SPDX. Store it with the release, protect its integrity, and connect it to the exact artifact. Include operating-system and container components where relevant.
A new compression-library advisory appears on Friday. The team has ten released images, and manifests alone cannot show which final images contain the affected operating-system package.
An SBOM makes that query possible, but only if it describes the released bytes and stays linked to their digest. An inventory generated too early can omit bundled or container components.
Generate an SPDX SBOM from a final application artifact or container and save it beside the artifact digest. Locate one direct, one transitive, and one operating-system component. Then add a component during the final build stage and prove whether the SBOM includes or misses it.
Lesson completed