Software Bill of Materials (SBOM)
Preferium AI Edge publishes a CycloneDX Software Bill of Materials and Sigstore-signed build-provenance attestations for every tagged release, so customers and auditors can independently inventory our dependencies and verify how our Worker bundles were built (SLSA-style supply-chain transparency).
What we publish
| Artifact | Format | How it is produced |
|---|---|---|
| Dependency SBOM | CycloneDX JSON (sbom.cdx.json) | Generated by anchore/sbom-action (syft) over the repository on every vX.Y.Z tag, in the attestations.yml CI workflow. |
| Build-provenance attestations | in-toto / SLSA, Sigstore-signed | Generated by GitHub actions/attest-build-provenance for the API + edge Worker bundles and for the SBOM itself; recorded in the public transparency log. |
The SBOM is attached to the attestation workflow run as the build artifact
sbom-cyclonedx.
How to obtain the SBOM
- Open the attestation workflow runs and select the run for the release tag you care about.
- Download the
sbom-cyclonedxartifact — it containssbom.cdx.jsonin CycloneDX JSON.
How to verify provenance
GitHub’s attestation tooling cryptographically verifies that a given Worker bundle (or the SBOM) was built by our pipeline, from our source, untampered:
gh attestation verify <artifact> --repo Preferium-AS/preferium-edgeWhy we link the attested source rather than re-host the JSON
The canonical SBOM is the signed, attested artifact produced by the release pipeline. Re-hosting an unsigned copy under a static trust URL would strip that cryptographic chain of custody and risk silent drift from the real build. We therefore point you to the attested artifact at its source of truth, where its provenance is verifiable end-to-end — rather than serving a detached, unverifiable copy here.
Questions about our supply-chain posture: security@preferium.com.