release: a CycloneDX SBOM of the machine, inside the tarball, beside it and attested

[aledbf]

S2 of the supply-chain plan (PR 9 in the table), for spin-machine.

• qemu/Dockerfile and e2fsprogs/Dockerfile: the extract stage copies the builder's /lib/apk/db/installed to _output/sbom/<part>.apk. It is a COPY out of the finished builder, so the compile stays cached. Rebuilt here, QEMU's binaries came out byte-identical. mkfs.ext4 changed only because the local cache had lost e2fsprogs' builder and apk add took newer packages, which are unpinned.

• hack/release writes the CycloneDX SBOM with go tool sbom. Its inputs:

  • the libraries each static binary links (sbom apk -only; the rest of the database is formulation);
  • the base image's packages.txt;
  • the pins of qemu, qboot, e2fsprogs, kernel, ubuntu, task, git-lfs and buildkit;
  • every shipped binary and firmware file by its hash.

  The parts are merged under machine.env into usr/share/spin-stack/sbom/machine.cdx.json in the tarball, and under the tarball's hash into <tarball>.cdx.json beside it. sbom check fails the release on a component with no version. SOURCE_DATE_EPOCH is the commit's time.

• release.yml:

  • cosign attest-blob --type cyclonedx over the tarball, verified;
  • the .cdx.json is published, signed and provenance-attested too;
  • attestgate files checks provenance on every file, and cdx on the tarball.

• workflows_test sets RequireSBOM. Planted: an attestation of another type fails it, at Publish.

• go-tools moves to 621f429, with the sbom tool.

Run locally, VERSION=v20261013.99 hack/release gives 454 components, all with a purl or hash: glib-static 2.88.1-r1, the kernel from its real URL, and 215 base-image packages.

Not here:

• Pedigree for the QEMU/kernel/qboot patches. The patches ship in the tarball, but go-tools' sbom has no pedigree yet.
• The SOURCES kernel URL still says cdn.kernel.org, while versions.yaml has git.kernel.org/torvalds (7.3-rc5); the SBOM names the right one.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}