Repository navigation
docs: describe signed sbom bundles in the sbom attestation type - #538
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
Claude finished @mintlify[bot]'s task in 1m 3s —— View job Follow-up review of latest commitsPrevious finding — resolved. The earlier comment flagged that the sentence on fingerprint-based subject checking didn't cover the case where a bundled SBOM is bound by template name and commit, or to the trail alone (no fingerprint, so the subject goes unchecked) — which could let a reader mistake an unchecked subject for verified evidence. Commit
I cross-checked this against the generated reference ( New issues in the changed lines: none. The addition is a self-contained clarification; no bugs or regressions introduced. Note: I wasn't able to query the GitHub review-comments API in this session (sandboxed, requires approval I can't grant), so I couldn't programmatically resolve the original inline thread — flagging this status here instead. The underlying docs change itself is sound. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| CycloneDX document from inside it. When the artifact's fingerprint is known, the attestation | ||
| must list that artifact as its subject. To verify who signed it, pass `--certificate-identity` |
There was a problem hiding this comment.
Improvement: this leaves out the case where the subject is not checked. The generated reference (client_reference/kosli_attest_sbom.md:28-32) says that when the attestation is bound by template name and commit, or to the trail alone, there is no fingerprint, so the subject is not checked. Line 336 now says only a plain SBOM's subject goes unchecked. Read together, the two lines suggest a bundled SBOM's subject is always checked, and a reader attesting to a trail could treat it as verified evidence when it isn't.
| CycloneDX document from inside it. When the artifact's fingerprint is known, the attestation | |
| must list that artifact as its subject. To verify who signed it, pass `--certificate-identity` | |
| CycloneDX document from inside it. When the artifact's fingerprint is known, calculated or | |
| given with `--fingerprint`, the attestation must list that artifact as its subject. Attested | |
| to a trail alone, or bound by template name and commit, it has no fingerprint, so the subject | |
| is not checked. To verify who signed it, pass `--certificate-identity` |
The SBOM attestation type now explains that
kosli attest sbomaccepts signed SBOMs in Sigstore bundles or DSSE envelopes, checks their subject and can verify the signer. It also points to the betakosli attest in-toto. GA for attest sbom bundles, beta for attest in-toto; both released in CLI v2.56.0.Based on feat: add kosli attest in-toto, recording attestations from bundle files.