|
2 | 2 | title: SBOM attestations |
3 | 3 | keywords: build, attestations, sbom, spdx, metadata, packages |
4 | 4 | description: | |
5 | | - SBOM build attestations describe the contents of your image, |
6 | | - and the packages used to build it. |
| 5 | + SBOM attestations describe what software artifacts an image contains and the artifacts used to create the image. |
7 | 6 | aliases: |
8 | 7 | - /build/attestations/sbom/ |
9 | 8 | --- |
10 | 9 |
|
11 | | -Software Bill of Materials (SBOM) attestations describe what software artifacts |
12 | | -an image contains, and artifacts used to create the image. Metadata included in |
13 | | -an SBOM for describing software artifacts may include: |
| 10 | +SBOM attestations help ensure [software supply chain transparency](/guides/docker-scout/s3c.md) by verifying the software artifacts an image contains and the artifacts used to create the image. Metadata included in an [SBOM](/guides/docker-scout/sbom.md) for describing software artifacts may include: |
14 | 11 |
|
15 | 12 | - Name of the artifact |
16 | 13 | - Version |
17 | 14 | - License type |
18 | 15 | - Authors |
19 | 16 | - Unique package identifier |
20 | 17 |
|
21 | | -There are benefits to indexing contents of an image during the build, as opposed |
22 | | -to scanning a final image. When scanning happens as part of the build, you're |
23 | | -able to detect software you use to build the image, that may not show up in the |
24 | | -final image. |
| 18 | +Indexing the contents of an image during the build has benefits over scanning a final image. When scanning happens as part of the build, you can detect software you used to build the image, which may not show up in the final image. |
25 | 19 |
|
26 | | -The SBOMs generated by BuildKit follow the SPDX standard. SBOMs attach to the |
27 | | -final image as a JSON-encoded SPDX document, using the format defined by the |
28 | | -[in-toto SPDX predicate](https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md). |
| 20 | +Docker supports SBOM generation and attestation through an SLSA-compliant build process using BuildKit and attestations. The SBOMs generated by [BuildKit](/manuals/build/buildkit/_index.md) follow the SPDX standard and attach to the final image as a JSON-encoded SPDX document, using the format defined by the [in-toto SPDX predicate](https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md). On this page, you’ll learn how to create, manage, and verify SBOM attestations using Docker tooling. |
29 | 21 |
|
30 | 22 | ## Create SBOM attestations |
31 | 23 |
|
|
0 commit comments