From 91f3b07a705108fab7d1ec3f3ebe4fdafc959fce Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Mon, 26 Oct 2026 06:16:57 +0000 Subject: [PATCH] docs(release): drop the nightly mirror from the image SBOM section The mirror copies main's builds from OCIR to GHCR, and only tags.yaml sets SBOM, so the mirror never sees an image that carries an attestation. Promotion is the only copy that moves one. Signed-off-by: Myasnikov Daniil Assisted-by: LLM --- docs/release.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release.md b/docs/release.md index 9e8b34cd8..00108e571 100644 --- a/docs/release.md +++ b/docs/release.md @@ -353,7 +353,7 @@ The script runs the same `cosign verify-blob` before it returns, so a signature ### SBOM of the container images -The container images a release pins by digest each carry an SPDX SBOM of the packages in them, which BuildKit attaches at build time as an attestation (`SBOM=1` in `tags.yaml`, scanner and flags in [`hack/common-envs.mk`](../hack/common-envs.mk)). The attestation is an entry of the image's index, so the digest the release pins names both, and promotion and the nightly mirror copy it with the image. Read it with `docker buildx imagetools inspect @ --format '{{ json .SBOM }}'`, which prints one document per platform. The attestations are not signed. A release cut before `SBOM=1` was set has none, and neither has the Talos installer image, which the imager builds and `skopeo` pushes, nor the third-party images `packages/` vendors by digest. +The container images a release pins by digest each carry an SPDX SBOM of the packages in them, which BuildKit attaches at build time as an attestation (`SBOM=1` in `tags.yaml`, scanner and flags in [`hack/common-envs.mk`](../hack/common-envs.mk)). The attestation is an entry of the image's index, so the digest the release pins names both, and promotion copies it with the image. Read it with `docker buildx imagetools inspect @ --format '{{ json .SBOM }}'`, which prints one document per platform. The attestations are not signed. A release cut before `SBOM=1` was set has none, and neither has the Talos installer image, which the imager builds and `skopeo` pushes, nor the third-party images `packages/` vendors by digest. ## Nightly builds