jorgemoralespou
commented
2 weeks ago - For SLSAv3, use GH Action slsa-framework/slsa-github-generator
- For SBOM generation use GH action: CycloneDX/gh-gomod-generate-sbom Also use cosign CLI to sign, attach, verify, ...
Is your feature request related to a problem? Please describe.
In the current times we live, where software provenance is a must for software adoption in regulated environments, we need to make sure we provide all the neccesary information for consumers to be safe about adopting our software
Describe the solution you'd like
Generate and distribute SBOMs (Software Build of Materials). There are currently many tools and services available that help with the task. The one I have found to be very effective is https://github.com/anchore/syft
Describe alternatives you've considered
No response
Additional information
No response