From bed3c1ad5d0b3e8bb8579928803a92ae4fd15333 Mon Sep 17 00:00:00 2001 From: David Cozens Date: Mon, 17 Aug 2026 21:57:56 +0100 Subject: [PATCH] docs: SLSA provenance is declined for a source-only project, not deferred Co-Authored-By: Claude Opus 5 (1M context) --- docs/security/sbom.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/security/sbom.md b/docs/security/sbom.md index d7049bf8..cd826c32 100644 --- a/docs/security/sbom.md +++ b/docs/security/sbom.md @@ -313,12 +313,13 @@ whether GitHub, Sigstore, or this project still exist at the time of audit. For a step-by-step verification guide aimed at downstream integrators, see [`release-verification.md`](./release-verification.md). -## Deferred - -- Signed SLSA provenance attestation. `cosign attest` on top of - `sign-blob` is a natural next step: it produces an attestation - statement that says "this SBOM was produced by this workflow from - these inputs" rather than just "this SBOM was signed by this - workflow." +## Out of scope + +- Signed SLSA provenance attestation. An attestation states "this SBOM + was produced by this workflow from these inputs"; the signature above + states only "this SBOM was signed by this workflow". The difference + matters for a binary the consumer cannot inspect. This project is + source-only and the content-tree hash is reproducible from any clone, + so the integrator checks the source itself. - Binary-artefact signing. The project is source-only; nothing to sign beyond the SBOM and content-tree hash.