Data as of Oct 5, 2026Based on 297 AI responses from ChatGPT Search and Google AI Mode
Reviewed by Dimitry Apollonsky ·
For proof of compliance, generate SBOMs with Syft (or cdxgen) and cryptographically sign them with Sigstore/Cosign to prove origin and integrity. If you need end-to-end automation, policy enforcement, and enterprise reporting, consider commercial platforms like Checkmarx or Orca.
Explore the market rankingSoftware Supply Chain Security Platforms
Primary topicSBOM signing and build provenance
Brands AI recommends here
Mentioned inRecommended in · Sep 8 – Sep 23, 2026
ChatGPT SearchSep 23, 2026
Yes. There are several credible options, ranging from open-source tooling you can run in CI/CD to commercial platforms that package SBOM generation, signing, provenance, and compliance evidence together.
| Provider / tool | SBOM generation | Signing / attestation | Formats | Best fit |
|---|---|---|---|---|
| Anchore — Syft + Cosign/Sigstore | ✅ | ✅ | SPDX, |
Google AI ModeSep 8, 2026
58% of citations to these sources link to brands' own websites.
chainloop.dev
The ultimate guide to SBOMs (opens in a new tab)Brand site2%about.gitlab.com
ox.security
ibm.com
openssf.org
| Open-source, CI/CD, containers |
| Aqua Security — Trivy | ✅ | Via Cosign/Sigstore workflows | SPDX, CycloneDX, Trivy | Broad vulnerability + SBOM scanning |
| Microsoft — SBOM Tool | ✅ | Can integrate with signing/provenance tooling | SPDX | Microsoft-heavy build environments |
| CycloneDX ecosystem | ✅ | Via Cosign/Sigstore and other tooling | CycloneDX | Standardized SBOM workflows |
| Sonatype | ✅ / SCA | Enterprise supply-chain controls | SPDX/CycloneDX and others | Enterprise OSS governance |
| ActiveState | ✅ | Signed SBOMs built in | SPDX, CycloneDX | Audit/compliance-oriented environments |
A particularly straightforward architecture is Syft + Sigstore/Cosign. Syft generates SBOMs from source, filesystems, archives, and container images, and supports both SPDX and CycloneDX.
More importantly for your situation, Syft now supports cryptographically signed SBOM attestations using in-toto and Sigstore. You can use either key-based signing or keyless OIDC-based signing, then verify the resulting attestation with Cosign.
A typical pipeline would be:
Source / Build
│
▼
Generate SBOM
(Syft / Trivy / Microsoft SBOM Tool)
│
▼
SBOM in SPDX or CycloneDX
│
▼
Create in-toto attestation
│
▼
Sign with Sigstore/Cosign
│
▼
Attach to OCI artifact / registry
│
▼
Verify during deployment/auditThe important distinction is that an SBOM by itself doesn't prove that it corresponds to the artifact you're shipping. A signed attestation establishes a cryptographically verifiable relationship between the SBOM and the artifact. Anchore explicitly describes this workflow as allowing consumers to verify that the SBOM represents the image contents.
For example, Syft supports:
syft myimage:1.2.3 -o cyclonedx-json > sbom.jsonand signed attestation workflows such as:
syft attest --key cosign.key \
--output cyclonedx-json \
myimage:1.2.3 > attestation.jsonThe resulting attestation can be attached to the image and verified with Cosign.
I'd look beyond just an SBOM generator. You generally want these four pieces:
If you tell me which compliance regime you need to satisfy (e.g. EO 14028/NIST SSDF, FDA, EU CRA, SOC 2, FedRAMP, automotive, aerospace) and whether you're using GitHub/GitLab/Azure/Jenkins + containers, I can narrow this to the appropriate vendors and give you a concrete reference architecture.
Proving software supply chain compliance requires a two-step process: generating a machine-readable inventory of all direct and transitive dependencies (in formats like SPDX or CycloneDX) and signing/attesting that inventory cryptographically to ensure it hasn't been tampered with.
A breakdown of top open-source utilities and enterprise platforms provides both capabilities:
in-toto SBOM attestations in a single command (syft attest).If you can share your primary CI/CD environment (e.g., GitHub Actions, GitLab, Jenkins) or the programming languages/artifact types you use, I can show you a quick snippet to integrate generation and signing into your pipeline.
Yes. If your goal is provable software-supply-chain compliance, I’d separate the market into SBOM generation, cryptographic signing/attestation, and central SBOM governance/evidence. NIST specifically recommends machine-readable SBOMs in formats such as SPDX or CycloneDX, and recommends digitally signed SBOM repositories.
| Provider / tool | SBOM generation | Signing / attestation | Management / compliance |
|---|---|---|---|
| Anchore — Syft + Enterprise | ✅ Syft generates SPDX/CycloneDX SBOMs | ✅ Syft/Cosign/Sigstore attestations | ✅ Enterprise governance, compliance evidence |
| Sigstore — Cosign | — | ✅ Signing & verification of SBOMs/artifacts | — |
| Synopsys — Black Duck | ✅ | Integration with signing/provenance tooling | ✅ SCA, license/policy compliance |
| Snyk | ✅ | Supply-chain/provenance integrations | ✅ SBOM management & security |
| Sonatype — Lifecycle | ✅ | Supply-chain integrations | ✅ Component governance/compliance |
| JFrog — Xray | ✅ | Artifact/signing ecosystem integrations | ✅ SBOM/security management |
| FOSSA | ✅ | Supply-chain integrations | ✅ License/SBOM compliance |
| Aqua Security — Trivy | ✅ SPDX/CycloneDX | Can be combined with Cosign | Vulnerability/SCA workflows |
| OWASP — Dependency-Track | Ingests SBOMs rather than primarily generating them | Can consume signed SBOMs | ✅ Open-source SBOM lifecycle management |
CycloneDX's own tool directory lists many of these products and distinguishes generation, lifecycle stage, and commercial/open-source availability.
For a build pipeline, a common architecture is:
Build → Syft → SBOM → Cosign/Sigstore → signed SBOM/attestation → registry → Dependency-Track or commercial platform
Syft can generate SBOMs from container images and filesystems in SPDX and CycloneDX formats.
Cosign, from Sigstore, can cryptographically sign and verify SBOMs and other artifacts. Sigstore's keyless model also records signing events in a tamper-resistant transparency log, which is useful when you need audit evidence rather than merely a .sig file sitting beside the SBOM.
Anchore also documents Syft-generated SBOM attestations using in-toto and Sigstore, including keyless OIDC signing and verification with Cosign.
I'd look beyond an SBOM generator. The evidence chain you want is approximately:
OWASP describes essentially this build → SBOM → digest → sign/attest → publish workflow.
If you tell me whether you're trying to satisfy NIST/EO 14028, EU Cyber Resilience Act (CRA), FDA/medical-device requirements, FedRAMP, SOC 2, ISO 27001, or an internal customer requirement, I can narrow this to 3–5 vendors and map their capabilities directly to the compliance evidence you need.
Proving software supply chain compliance can feel like chasing a moving target, but you don't have to build the machinery from scratch. Tackling this requires separating the job into generation (making the ingredient list) and signing (cryptographically sealing it so downstream systems trust it).
A mix of strong open-source utilities, cloud ecosystems, and commercial platforms handle both steps natively:
To help narrow down the best fit for your team, tell me:
Proving software supply chain compliance requires a two-step approach: generating a machine-readable inventory of your software components (SPDX or CycloneDX format) and cryptographically signing that inventory to guarantee authenticity and tamper-evidence.
A breakdown of top open-source, commercial, and combined tools handles both SBOM generation and artifact signing:
To help narrow down the right solution, could you tell me:
Yes. There are several established vendors/projects that can address both SBOM generation and cryptographic signing/attestation. The important distinction is that SBOM generation and SBOM signing are often separate functions.
| Provider / tool | SBOM generation | Signing / attestation | Enterprise/compliance capabilities |
|---|---|---|---|
| anchore.com | Yes — containers, filesystems, source/projects; SPDX, CycloneDX, Syft JSON | Yes — in-toto/Sigstore attestations | Anchore Enterprise adds centralized SBOM management, policy enforcement, vulnerability/license analysis and compliance workflows |
| sigstore.dev | No primary SBOM generator | Yes — strong focus on signing and verification | Keyless signing, short-lived certificates and transparency logging |
| cyclonedx.org | Yes — broad ecosystem of generators | Cosign and other tools integrate with CycloneDX | Open standard/ecosystem rather than a single commercial vendor |
| Synopsys / Black Duck | Yes — generates SPDX/CycloneDX SBOMs | Supply-chain/artifact security integrations | SCA, vulnerability and license compliance, policy management |
| Microsoft SBOM tooling | Yes | Can be combined with signing/attestation tooling | Particularly useful in Microsoft/Azure/GitHub-oriented environments |
Anchore's Syft is particularly straightforward if your immediate problem is "we need evidence that an SBOM was generated for every release." It can generate standardized SPDX or CycloneDX SBOMs and supports signed SBOM attestations.
For the signing layer, Sigstore/Cosign is a prominent open-source approach. Sigstore explicitly supports signing SBOMs and other software artifacts; its ecosystem uses short-lived/ephemeral signing credentials and a transparency log, which can provide useful audit evidence.
If your goal is provable software-supply-chain compliance, I'd think about the pipeline as:
Build → Generate SBOM → Sign/attest SBOM → Store evidence → Verify at release/deployment
For example:
Syft → CycloneDX/SPDX SBOM → Cosign/Sigstore → OCI registry/artifact store → CI/CD policy gate
The critical part is not merely producing an SBOM. You want evidence tying the SBOM to a specific immutable build artifact, ideally with provenance and a verifiable signature. Syft's attestation workflow is explicitly designed to create cryptographic proof that an SBOM describes a particular container image.
If you need a managed enterprise platform rather than assembling open-source components, Anchore Enterprise is worth looking at: it stores and manages SBOMs, supports SPDX/CycloneDX, evaluates policies, and provides compliance-oriented workflows.
If you tell me your environment (e.g. GitHub Actions/Azure DevOps/Jenkins + Docker/Kubernetes + AWS/Azure/GCP), I can map out 3–5 concrete SBOM/signing vendors and an architecture for producing audit-ready evidence.
Proving software supply chain compliance requires a two-step approach: generating a machine-readable inventory of all components (the SBOM) and signing both the software artifacts and the SBOM to cryptographically prove their integrity and origin.
The industry relies on a combination of open-source utilities, cloud-native projects, and commercial platforms to handle generation and signing.
These tools inspect source code, container images, file systems, or lockfiles and export standardized formats like CycloneDX or SPDX.
Once you have generated an SBOM, you need to sign it (and your container/artifact) to establish provenance and non-repudiation.
A standard compliance loop generally chains these tools together:
syft or trivy in your CI/CD pipeline to output an sbom.json.grype or dependency-track against the SBOM to evaluate risks.cosign to sign the container image and attach/sign the sbom.json as an in-toto attestation.To help tailor this to your environment, let me know:
Several providers can address this:
For compliance evidence, Syft + Sigstore/Cosign is a strong open-source starting point because it can generate the SBOM and create a verifiable cryptographic attestation. NIST specifically recommends digitally signed SBOM repositories.
Proving compliance for a software supply chain typically requires a two-step mechanism: Generation (creating a machine-readable inventory of components, usually in CycloneDX or SPDX formats) and Signing/Attestation (cryptographically binding that inventory to your build artifact so it cannot be tampered with).
Tool providers span open-source utilities, cloud-native toolchains, and enterprise security platforms.
These tools are widely adopted, integrate directly into CI/CD pipelines (GitHub Actions, GitLab CI), and handle generation and signing natively or in tandem.
attestations linked to an image digest.If you require centralized governance, compliance policy enforcement, automated key management, and audit-ready reporting dashboards, commercial platforms bundle generation, vulnerability scanning, and signing together.
A standard pipeline combines Syft or cdxgen to generate the raw inventory file, followed immediately by Cosign in your CI/CD runner to attest and sign the file before publishing it to your artifact registry.
To help narrow down the right choice, tell me:
If you cannot prove software supply chain compliance, you usually need two capabilities:
Common providers and tools include:
| Provider / Tool | SBOM generation | Signing / attestation | Typical use |
|---|---|---|---|
| Anchore (Syft + related products) | Syft generates SBOMs from containers, filesystems, and images in SPDX/CycloneDX formats | Integrates with signing and supply-chain workflows | Open-source + enterprise SBOM pipelines |
| Sigstore (Cosign) | Consumes SBOMs and supply-chain metadata | Strong option for signing container images, SBOMs, and attestations | Kubernetes/container supply chains |
| Aqua Security (Trivy) | Generates SBOMs while scanning containers, repositories, and filesystems | Supports supply-chain security workflows | DevSecOps pipelines |
| Synopsys (Black Duck) | Generates CycloneDX/SPDX SBOMs and performs SCA analysis | Enterprise governance and compliance reporting | Large organizations |
| GitHub (GitHub Advanced Security / dependency tooling) | Generates SBOMs from repositories and dependency data | Supports artifact attestations and provenance workflows | GitHub-native CI/CD |
| Microsoft (Microsoft SBOM Tool) | Generates SPDX SBOMs from build outputs | Commonly paired with signing and Azure DevOps workflows | Windows/.NET and enterprise builds |
| OWASP (CycloneDX ecosystem) | Defines SBOM standard and maintains tooling ecosystem | Often paired with signing tools | Standardized SBOM exchange |
| Linux Foundation (SPDX ecosystem) | Defines SPDX SBOM standard and provides tooling | Often paired with Sigstore and provenance systems | Compliance-focused environments |
CycloneDX CycloneDX## Common implementation pattern
A typical compliant pipeline looks like:
If your issue is not just generating SBOMs but proving compliance to customers, auditors, or regulators, look at platforms such as:
For many organizations trying to satisfy requirements such as NTIA SBOM minimum elements, EO 14028 expectations, NIST SSDF, or customer security questionnaires, a reasonable starting stack is:
The key compliance gap is often not "we cannot make an SBOM"; it is "we cannot prove that this SBOM belongs to this exact release artifact and was generated by a trusted build process." Signing plus provenance attestation addresses that gap.
