Patch release correcting how the SBOM attestation is published so it is discoverable and verifiable alongside the image signatures and SLSA provenance shipped in v0.49.0.
Bug Fixes
- SBOM attestation now published as an OCI 1.1 referrer — the per-image SPDX SBOM was previously attached via
cosign attest, which writes the legacy.atttag that neithercosign verify-attestationnorgh attestation verifyreads as a referrer. It is now attached withactions/attest-sbom(push-to-registry), the same discovery path as the SLSA provenance, sogh attestation verify oci://<image> --repo mattrobinsonsre/terrapod --predicate-type https://spdx.dev/Documentsucceeds. Image + Helm-chart signatures and SLSA provenance were already verifiable and are unchanged. (#626)
Verifying
See Supply-chain verification. All artifacts in this release were verified end-to-end: image signature, chart signature, SBOM (referrer), and SLSA build provenance.
Status
Beta — production-capable; APIs stabilising.
Full Changelog: v0.49.1...v0.49.2