OpenSSF project
SBOMit
An SBOM-format-independent method that embeds in-toto and Witness attestations into Software Bills of Materials, cryptographically validating the steps performed across the software supply chain.
How each persona uses SBOMit
Software Developer / Maintainer Developer
Generates an SBOM whose entries are backed by signed attestations of how each component was actually built.
Security Engineer / Architect Security
Validates the in-toto attestations carried inside an SBOM to confirm the supply-chain steps behind every listed component.
CI/CD DevOps & Tooling Integrator DevOps
Produces attestation-backed SBOMs as a release step so provenance travels with the component inventory automatically.
Package & Repository Manager Package Manager
Distributes SBOMs whose contents are cryptographically tied to verifiable build steps, raising the trust of served packages.
Problems SBOMit helps with
Build & Provenance Integrity Build Integrity
Binds in-toto and Witness attestations to SBOM entries so each component carries verifiable proof of how it was built.
Dependency & SBOM Visibility Visibility
Produces a standard SBOM as the carrier for that provenance, keeping the component inventory and its evidence together.
Artefact Signing & Verification Signing
Relies on signed attestations over components, so the bill of materials itself becomes cryptographically verifiable.