Post

Signed your SBOM? That is the middle, not the end. How I store, verify and rescan it with Harbor, Dependency-Track, GUAC, Ratify and Kyverno, with CRA in mind. www.msbiro.net/posts/sbom-s... #SBOM #SupplyChain

msbiro.netYou Built and Signed Your SBOM. Now What? Store, Verify, ManageSBOMs fail when we abandon them after signing. Where to store your SBOM, how to verify it is real, and how to manage retention and continuous scanning with FOSS tooling.

6/10/26, 1:24 pm0 reposts0 likes

devtocash.bsky.social

@devtocash.bsky.social

Good operational half. One Kyverno gotcha: verifyImages attestations[].type must match the envelope predicateType exactly. cosign attest --type cyclonedx emits https://cyclonedx.org/bom, so a custom --predicate-type URI fails as 'no matching attestation'. Pin one URI in both CI and the policy.