Issue #75 — Supply-Chain Security: SLSA Provenance, Signed Releases & SBOM Attestation

[Topmatrixmor2014]

Publish SLSA provenance, sign release artifacts, and attest SBOMs so downstream consumers can verify what they're deploying.

Requirements and Context

.github/workflows/sbom-scan.yml already generates SPDX/CycloneDX SBOMs weekly, and release.yml publishes releases. The missing pieces are SLSA provenance generation (attesting the build came from this repo/ref), artifact signing (cosign), and attaching the SBOM to each release — the standard controls that make supply-chain claims verifiable.

Objectives

1. Add a release workflow step that generates SLSA provenance (e.g., slsa-framework/slsa-github-generator).
2. Sign release artifacts and container images with cosign and attach signatures.
3. Attach the generated SBOM to each release asset and the OCI image.
4. Document how consumers verify provenance/signatures in docs/.

Suggested Execution

1. git checkout -b feat/slsa-provenance.
2. Extend .github/workflows/release.yml (and sbom-scan.yml) with provenance + cosign steps.
3. Add docs/supply-chain-verification.md.
4. Validate workflow YAML and perform a dry-run release on a test tag.

Acceptance Criteria

• Releases include SLSA provenance and signed artifacts.
• Container images are signed and carry an SBOM attestation.
• Verification instructions are documented and reproducible.
• Workflow YAML validates (no lint errors).

Guidelines

• Use pinned action SHAs for the provenance/signing steps.
• Keep the existing weekly SBOM job; this adds per-release attestation.

Timeframe: 96 hours

---

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.

[midenotch]

Hi Maintainer,
Interested in working on this issue. I'll implement the requested changes and ensure everything is properly tested before submission.

Payout wallet (Stellar): GBLT6QSRPF7YGSCOWEOGBXKS2DRKOPBLF6QHJAD6QCNCWWQ54E2NJ4AB
GrantFox OSS campaign — smart escrow payout on merge.

[olatechy0]

Hi i would like to work on this issue please assign to me
I can do it perfectly

[grantfox-oss]

🦊 GrantFox — @olatechy0 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #644)
2. Your PR will be reviewed by the FinChippay maintainers

Good luck! Track your progress on GrantFox.