docs(security): the task SBOM is the base SBOM, attested — read it with cosign verify-attestation - #163
Draft
LukasWodka wants to merge 2 commits into
Draft
docs(security): the task SBOM is the base SBOM, attested — read it with cosign verify-attestation#163LukasWodka wants to merge 2 commits into
LukasWodka wants to merge 2 commits into
Conversation
…ith cosign verify-attestation; provenance stays inline Held until tracebloc-engine#950 (backend#3317 lever c) merges: this page must not describe unshipped behaviour. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…to the base's inline SBOM (backend#3439 part 3) Still held until tracebloc-engine#961 merges. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Author
|
Amended to the attest-by-reference form (tracebloc-engine#961, backend#3439 part 3): the consumer still runs |
LukasWodka
requested review from
saqlainsyed007
and removed request for
saadqbal
September 9, 2026 15:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DRAFT = HOLD until tracebloc/tracebloc-engine#950 merges (backend#3317 lever c). Docs must not describe unshipped behaviour; this page changes how a customer reads a task image's SBOM.
What changes on the page
Section View the SBOM and provenance of
environment-setup/security.mdx: the task image's SBOM becomes a cosign attestation on the digest (cosign verify-attestation --type spdxjsonwith the same identity regexp as the signature; one SPDX statement per platform), while build provenance stays inline (imagetools inspect --format '{{ json .Provenance }}') and names the base digest. The base images carry their SBOM inline. A<Note>covers the one-release transition (older digests behind:stg/:prodstill answer to the inline command).Why
The task Dockerfiles install nothing (a publish-time guard now refuses any change that would), so the SBOM of a task image is by construction the base image's; generating it per leg cost ~15 min of the longest task-image build. Details on tracebloc/tracebloc-engine#950.
Checklist
develop(the page lives there)