SBOM Package

Checks general properties of the SBOMs associated with the image being validated. More specific rules for SPDX and CycloneDX SBOMs are in separate packages.

Package Name

  • sbom

Rules Included

Disallowed packages list is provided

Confirm the disallowed_packages and disallowed_attributes rule data were provided, since they are required by the policy rules in this package.

Solution: Provide a list of disallowed packages or package attributes in the expected format.

  • Rule type: FAILURE

  • FAILURE message: %s

  • Code: sbom.disallowed_packages_provided

  • Source

Found

Confirm an SBOM attestation exists.

Solution: Make sure the build process produces an SBOM attestation.

  • Rule type: FAILURE

  • FAILURE message: No SBOM attestations found

  • Code: sbom.found

  • Source

SBOM signature verification failed

Report when signature verification fails for SBOMs discovered via OCI referrers or image-tag refs. The SBOM is excluded (fail-closed), but the user should know why.

Solution: Check that the SBOM was signed with the key or certificate configured in the "sbom" entry of the signing_identities rule data, or that the signing identity matches.

  • Rule type: WARNING

  • WARNING message: %s

  • Code: sbom.signature_verification

  • Source