go-attest

An artifact needs two things said about it: who vouches for it and what is inside it. These two packages do one each, over the same bytes, so a release pipeline can emit both without a second toolchain.

Conformance is not asserted, it is decoded: the SBOM output is parsed back by the reference SPDX and CycloneDX libraries in test-only code, so a document that those tools would reject cannot pass CI here.

Repositories

sign signing

Ed25519 over the artifact bytes

Ed25519 signing that is interoperable with both encodings an artifact is distributed under. A plain signature over the same bytes either way, so one keypair covers both channels rather than forcing a choice between them.

sbom inventory

SPDX 2.3 JSON + CycloneDX 1.5 JSON

Emits a software bill of materials for a build artifact and its dependency closure, in both formats.

Conformance is proven in test-only code by decoding the output with the reference libraries — the documents are checked by the tools that consume them, not by our own reader.

Both packages are ordinary Go libraries with no cgo and no external binaries, so they drop into a build pipeline that already produces the artifact — no separate signing daemon, no Node, no Python.