All pull requests

Pull requests

• chore(deps): SUB-9486 upgrade to grype v0.121.0 and syft v1.55.0

  ai-assistedai-reviewed-localrelease
  #1224·jnathangreeg opened Oct 29, 2026Contributor·

  ·
  1

  10

• docs(sbom): add an executable attestation publisher and operator guide

  #1210·doraem-on opened Oct 24, 2026Member·

  ·
  4

• test(sbom): prove real Syft and Grype parity for signed inventories

  #1209·doraem-on opened Oct 24, 2026Member·

  ·
  6

• feat(metrics): expose bounded inventory acquisition outcomes and bytes

  #1208·doraem-on opened Oct 24, 2026Member·

  ·
  5

• feat(config): opt in to verified registry inventory acquisition

  #1207·doraem-on opened Oct 24, 2026Member·

  ·
  5

• feat(sbom): revalidate imported caches against current trust policy

  #1206·doraem-on opened Oct 24, 2026Member·

  ·
  4

• fix(storage): preserve and invalidate imported inventory provenance

  #1205·doraem-on opened Oct 24, 2026Member·

  ·
  4

• feat(sbom): fall back to the configured creator for ineligible imports

  #1204·doraem-on opened Oct 24, 2026Member·

  ·
  4

• feat(sbom): acquire verified registry inventories with provenance

  #1203·doraem-on opened Oct 24, 2026Member·

  ·
  5

• feat(sbom): validate Syft inventory profile and source identity

  #1202·doraem-on opened Oct 24, 2026Member·

  ·
  3

• feat(sbom): verify DSSE in-toto inventory attestations

  #1201·doraem-on opened Oct 24, 2026Member·

  ·
  4

• feat(sbom): resolve immutable subjects and discover OCI inventory attestations

  #1200·doraem-on opened Oct 24, 2026Member·

  ·
  4