Supply chain
What's verifiable about an Algenta release today — SBOMs and a vulnerability scan per image — and what isn't yet, stated as plainly as what is.
What exists today
Every release build (API, worker, and engine images) runs through the same step in CI, against the exact image just pushed, referenced by digest rather than by a tag like latest — a tag can move between the push and the scan; a digest cannot.
SBOM
SPDX (*-sbom.spdx.json)
anchore/sbom-action
SBOM
CycloneDX (*-sbom.cyclonedx.json)
anchore/sbom-action
Vulnerability report
JSON (*-vulnerabilities.json)
anchore/scan-action (Grype)
All three are uploaded as GitHub Actions workflow artifacts (90-day retention) for every image, on every push to main.
syft <registry>/<image>@<digest> -o spdx-json
syft <registry>/<image>@<digest> -o cyclonedx-json
grype <registry>/<image>@<digest> -o jsonWhy the scan is advisory, not a release gate
Every image has known CVEs in its base OS packages the day it's built — that's normal, not a defect specific to this project — and turning that into a hard release-blocking gate on day one would either block every release or get disabled at the first false positive. The scan makes the finding visible and diffable release-over-release; making specific severities blocking is a deliberate follow-up, done once there's a triaged baseline to ratchet against — the same pattern this repository already applies to its own internal reliability guards.
What does not exist yet
Stated directly, because a partner evaluating this page will check:
Image signing (cosign)
Not built. A signing key is a permanent trust anchor the moment any customer starts verifying against its public half — rotating it later is disruptive in a way that adding a new SBOM format isn't. Which key-custody model (and whether keyless signing is acceptable given air-gapped customers can't reach Rekor/Fulcio) is an owner decision, tracked separately from the scan-and-report step above.
Helm chart signing / OCI provenance
Not built. Blocked on the same decision, and on the chart itself merging (see Capability status).
SLSA / in-toto provenance attestation
Not built.
VEX statements for triaged/accepted findings
Not built. The vulnerability report above is raw scanner output; nothing has been triaged into "known, accepted, not exploitable in this configuration" yet.
Reproducible-build verification
Not built.
Do not describe a release as "signed" or "provenance-attested" until the corresponding row above changes — this page will be updated in the same change that ships the control, not ahead of it.
Dependency lockfiles
Python dependencies are pinned via lockfiles committed to this repository; the Python and TypeScript SDKs are published from tagged releases through a Trusted-Publishing OIDC pipeline with no long-lived registry tokens to leak — see the SDK repository for that pipeline's own detail, which is out of this repository's scope to restate.
Next steps
Last updated
Was this helpful?