Trust & supply chain security

Verify in 30 seconds

Uses the GitHub CLI's built-in attestation verifier. No key management required.

gh release download v0.0.0 --repo sbom-tool/sbom-tools \
  --pattern 'sbom-tools-*.tar.gz'

gh attestation verify sbom-tools-*.tar.gz \
  --repo sbom-tool/sbom-tools

A successful run prints Loaded digest ... Verification succeeded! and shows the workflow that built the binary, the commit SHA, and the Sigstore transparency log entry.

Download any Sigstore .bundle, the .intoto.jsonl provenance, or a DSSE envelope from release v0.0.0 and drop it below to see the builder identity, source commit, workflow, timestamps, and signed subjects. The file is parsed with JavaScript on this page — it never leaves your device. (GitHub release assets don't set CORS headers, so direct auto-fetch from the browser isn't possible; this pattern keeps the flow fully local and auditable.)

Each release ships a signed in-toto attestation describing the exact GitHub Actions workflow, commit SHA, and runner that produced every published artifact. Consumers can cryptographically prove a binary came from our source tree — not a supply-chain intermediary.

Every release archive and the release manifest are signed with Sigstore using OIDC identity from the GitHub Actions runner — no long-lived signing keys to steal or rotate. Signatures are recorded in the public Rekor transparency log so tampering is publicly detectable.

cosign verify-blob \
  --bundle sbom-tools-linux-x86_64.tar.gz.bundle \
  --certificate-identity-regexp 'https://github.com/sbom-tool/sbom-tools/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  sbom-tools-linux-x86_64.tar.gz

GitHub publishes an independent, first-party attestation for every binary in the release. These are queryable via gh attestation verify and don't require the release archive to be present — you can verify a binary you already have installed.

Every release publishes a signed manifest of SHA-256 checksums for all artifacts. This lets you verify a downloaded binary matches exactly what the maintainers signed off on, even without running Sigstore or SLSA tooling.

We ship the tool's own bill of materials in both major formats so you can audit our dependency tree with the same workflows you'd use for any other supplier.