019-release-supply-chain-artifacts

Release supply-chain artifacts: per-target SBOM and build provenance

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Every prebuilt binary spec-spine ships should carry a machine-readable bill of materials and a verifiable provenance trail. This spec adds, to the tag-gated release pipeline (006's release.yml), a per-target CycloneDX SBOM generated by syft for each of the five release archives, plus a SLSA build-provenance attestation over each archive. The SBOM names the dependency graph baked into that binary (read from the committed Cargo.lock, so it is as deterministic as the build); a fail-closed check refuses to ship an SBOM with zero components. SBOMs are attached to the GitHub Release as separate assets named to match their archive; the provenance attestation is recorded in GitHub's attestation store so any archive verifies with `gh attestation verify`. This is a port of OAP spec 117, scaled to spec-spine's single-CLI, five-triple release. The channels themselves (crates.io, npm, PyPI) are unchanged; this is purely additive supply-chain metadata on the binary release.

Read the full pinned specification ↗

Relationships

depends on

006-distribution

depended on by

188-a-repository-pin-selects-the-engine

Claimed units

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/release.yml"
  }
}

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": "docs/releasing.md"
  }
}

Source headings

019: Release supply-chain artifacts (per-target SBOM and build provenance)
1. Purpose
2. Territory
3. Behavior
4. Out of scope

Frozen anchors

No frozen anchors declared.