domains / families / security / sbom-supply-chain

sbom-supply-chain

authentic

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.

When to use

• Producing SBOMs for container images or application builds
• Verifying dependencies before deploy
• Enforcing signed artifact and provenance policies
• Preparing for SOC2, ISO 27001, or customer security reviews
• Implementing SLSA framework requirements
• Responding to supply chain vulnerabilities (e.g., Log4Shell-style events)

Skill page

Source