SOFTWARE SUPPLY CHAIN

Know what is in the release and how it was produced.

CycloneDX 1.7 inventory

Machine-readable first-party file inventory with SHA-256 hashes.

Open BOM

SLSA-inspired provenance

Unsigned build metadata describing release subjects and build context. It is not a signed SLSA attestation.

Open provenance

Quality Gates

Release promotion should depend on automated tests, integrity checks and human approval.

Quality gates