Introduction

I wrote Supply Chain Security: A Deep Dive into SBOM and Code Signing earlier. That post pinned down "what's in it" via SBOM and "who signed it" via Cosign.

But even with both of those, there's still a hole.

SolarWinds' SUNSPOT was malware that lived on the build server, swapped the source code the moment a build started, and put it back when the build finished. The resulting binaries were signed with the legitimate certificate. Signatures: perfect. SBOMs: clean. And the world still got a backdoor distributed to it.

Why? Signatures only prove "I signed this with this key." SBOMs only describe "what was in the artifact at build time." Nobody was verifying "was this really built from the right source, on an unaltered builder, following the steps it claims?"

The thing that closes that hole is Provenance .…