slsa-framework / slsa-github-generator

Language-agnostic SLSA provenance generation for Github Actions
Apache License 2.0
412 stars 126 forks source link

[doc] Add examples for incorporating a generated SBOM in the generic provenance #721

Open laurentsimon opened 2 years ago

laurentsimon commented 2 years ago

SBOMs are one artifact that a build system may output, in addition to other binaries, tarballs, etc We should document this in the doc https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/generic

This may also work for generic containers. @asraa @ianlewis

@lumjjb Let's work on this together

lumjjb commented 2 years ago

For additional context, this is the branch that @mdeicas and I worked on: https://github.com/lumjjb/slsa-github-generator-go/blob/sbom/.github/workflows/slsa3_builder.yml