Software Bill of Materials (SBOM)

Software Bill of Materials (SBOM)

Every ɳSelf CLI release ships a signed Software Bill of Materials (SBOM) in CycloneDX 1.5 and SPDX 2.3 formats alongside the release tarballs. This lets you verify exactly what is in each release binary, query for CVE exposure, and satisfy dependency attestation requirements for regulated environments.

What is shipped on every release

Artifact	Format	Description
sbom.cdx.json	CycloneDX 1.5 JSON	All Go module dependencies with versions and package URLs
sbom.cdx.json.bundle	Cosign bundle	Sigstore keyless signature for the CycloneDX SBOM
sbom.spdx.json	SPDX 2.3 JSON	Same dependency data in SPDX format
checksums.txt	SHA-256	SHA-256 digests for tarballs and both SBOMs

All artifacts are on the GitHub Releases page for each v* tag at github.com/nself.

How signing works

Signatures use Cosign keyless signing via the Sigstore ecosystem. There are no long-lived private keys to protect or rotate. The signature is bound to the GitHub Actions OIDC token issued at release time and recorded in the Rekor transparency log.

OIDC issuer:  https://token.actions.githubusercontent.com
Identity:     https://github.com/nself-org/cli/.github/workflows/release.yml@refs/tags/v*
Transparency: Rekor (public, immutable)

Verifying a release SBOM

Using the verify script (easiest)

# Downloads and verifies sbom.cdx.json for v1.1.0 automatically
bash tools/sbom/verify.sh v1.1.0

Manual verification with cosign

# Install cosign (macOS)
brew install cosign

# Download the SBOM and its bundle
curl -fsSL https://github.com/nself-org/cli/releases/download/v1.1.0/sbom.cdx.json \
  -o sbom.cdx.json
curl -fsSL https://github.com/nself-org/cli/releases/download/v1.1.0/sbom.cdx.json.bundle \
  -o sbom.cdx.json.bundle

# Verify, exits 0 on success, 1 on tamper or invalid signature
cosign verify-blob sbom.cdx.json \
  --bundle sbom.cdx.json.bundle \
  --certificate-identity-regexp "^https://github.com/nself-org/cli/.github/workflows/release\.yml@refs/tags/v" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --rekor-url "https://rekor.sigstore.dev"

A successful verification prints Verified OK. If verification fails, the SBOM may have been tampered with, do not use artifacts from that release.

Checking SHA-256 integrity

# Download checksums.txt alongside the SBOM
curl -fsSL https://github.com/nself-org/cli/releases/download/v1.1.0/checksums.txt -o checksums.txt
sha256sum --check --ignore-missing checksums.txt

Querying the SBOM for CVE exposure

When a new CVE is published, you can check whether your ɳSelf CLI release is affected before waiting for an advisory:

# Is package "cobra" in v1.1.0?
bash tools/sbom/query.sh v1.1.0 --pkg cobra

# Which packages in v1.1.0 are affected by CVE-2024-45337?
# Requires grype: https://github.com/anchore/grype
bash tools/sbom/query.sh v1.1.0 --cve CVE-2024-45337

# Query a locally-downloaded SBOM
bash tools/sbom/query.sh --local sbom.cdx.json --pkg spf13

Generating an SBOM for your own builds

If you build ɳSelf from source, generate your own SBOM with syft:

# Install syft
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
  | sh -s -- -b /usr/local/bin

# Generate from source tree (in cli/ repo root)
make sbom
# Writes: sbom.spdx.json  (SPDX 2.3)
#         sbom.cdx.json   (CycloneDX 1.5)

Security policy

All security features in ɳSelf are free and enabled by default. SBOM generation and supply chain signing are part of the free tier and always will be.

To report a vulnerability, see the Security Policy.

SLSA compliance

SBOM + cosign keyless signing moves ɳSelf CLI toward SLSA Level 2:

Requirement	Status
Source on version control	Done
CI builds (not developer laptop)	Done
Provenance (provenance.intoto.jsonl)	Done
Signed provenance	Done (cosign keyless)
SBOM attached to release	Done (CycloneDX + SPDX)