SBOM distribution and attestation — SBOM as an in-toto attestation

A SBOM that lives in CI artifact storage is a SBOM that disappears with the retention window. The production-graded distribution is to attach the SBOM to the artifact digest as a signed attestation in the registry. The attached SBOM lives as long as the image digest lives; the signature proves the attestation was produced by the build pipeline; the in-toto envelope makes the SBOM a structured claim that any verifier can read.

Why the SBOM must move with the artifact

The SBOM is an inventory of the artifact bytes; the bytes are identified by their digest. A SBOM stored anywhere else must be re-anchored to the digest at every query. The registry-native distribution is the OCI referrer model: a SBOM attached to an image is stored as a separate OCI artifact that refers to the image digest, and the registry indexes the referrer.

flowchart LR
    A["Image (digest)"] --> B["Registry"]
    B --> C["SBOM (referrer)"]
    B --> D["Signature"]
    B --> E["Provenance (referrer)"]
    C --> F["in-toto envelope"]
    F --> G["Signed payload"]

The in-toto envelope and cosign attach sbom

The SBOM is wrapped in an in-toto attestation before it is attached. The envelope is a JSON document with two layers: the statement (the predicate type, the subject, and the predicate — the SBOM) and the signature (the signed payload plus the certificate and the Rekor entry). The in-toto project defines https://spdx.dev/Document for SPDX documents and https://cyclonedx.org/bom for CycloneDX documents.

The cosign commands:

cosign attach sbom --sbom sbom.spdx.json \
    ghcr.io/org/app:$COMMIT_SHA
cosign sign --keyless ghcr.io/org/app:$COMMIT_SHA

The first command uploads the SBOM as an OCI referrer; the second signs the image and the referrer. The verifier runs cosign verify-attestation --keyless --certificate-identity-regexp ... — the OIDC subject proves the attestation was produced by this workflow.

Production discipline

1. Attach the SBOM to the artifact digest as a signed attestation. The CI artifact is a backstop.
2. Pin the OIDC subject in the verifier (a wildcard is too permissive) and verify in the admission controller.
3. Monitor Rekor inclusion. A signature without a Rekor entry has lost the tamper-evidence property.

Cross-course references

• Git, CI/CD & GitOps — Part LIII-06 (Image Signing in CI) is the cosign and Sigstore foundation that the SBOM attestation reuses.

Quiz