Myasnikov Daniil ce054baa34 feat(release): attach an SBOM to every release image ...

A release said nothing about what is inside its container images, so a
user could not tell which packages a cluster runs. SBOM=1 had been
plumbed for it and left off.

BuildKit attaches the SBOM as an attestation, which makes the pushed
image an index of the image and its attestation manifest. The stitch took
such an index for something other than one amd64 and one arm64 image,
skipped it and still exited 0, and the multi-arch gate then failed the
release, so the stitch now reads through the index and the stitched one
keeps both attestations. The release build ran on the default docker
driver, which cannot attach attestations, so it moves to the
docker-container builder with the docker.io mirror, as the arm64 leg
already did. The scanner is pinned by digest where --sbom=true pulls a
floating tag.

The Talos installer image is built by the imager and pushed by skopeo, so
it carries no attestation.

Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-10-20 16:40:06 +05:00

..

reports

docs(security): publish vulnerability reporting and a backlog reconciliation

2026-08-11 00:40:31 +05:00

incident-response.md

docs(security): fix the supported set at three lines and record that no backport rule exists

2026-08-10 21:55:37 +05:00

self-assessment.md

feat(release): attach an SBOM to every release image

2026-10-20 16:40:06 +05:00

threat-model.md

feat(redis)!: refuse external access without TLS at admission

2026-10-03 01:42:57 +03:00