Know exactly what's inside. Prove exactly where it came from.

An SBOM is a machine-readable ingredients list. Signing proves an artifact came from your trusted build, untampered. SLSA gives both a shared maturity scale.

syft · cosign

# generate an SBOM (CycloneDX format)
syft myapp:1.2.3 -o cyclonedx-json > sbom.json

# keyless signing — no long-lived private key
cosign sign myregistry.io/myapp:1.2.3
cosign verify --certificate-identity="...build.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  myregistry.io/myapp:1.2.3

SLSA build track — a shared maturity scale

Provenance exists

Not yet tamper-resistant.

Signed & hosted

Tamper-resistant, hosted build platform.

Hardened platform

Isolated between builds, can't be influenced.

When the next Log4Shell drops, an SBOM turns "are we affected" from a days-long audit into an instant search.