Audit the supply chain of a release

Read the attestations attached to an Omnia image, check that a published SBOM file matches them, and rebuild the aggregate SBOM from the per-image documents.

Prerequisites

Docker with buildx, and jq.
Pull access to ghcr.io/altairalabs.
For the last procedure, a checkout of the Omnia repository (for hack/sbom-aggregate.py) and python3.

The attestations are generated by BuildKit and are not signed. See Supply-chain evidence for what is published.

Read the SBOM from an image

docker buildx imagetools inspect \
  ghcr.io/altairalabs/omnia-operator:<version> \
  --format '{{json .SBOM}}'

Read the provenance from an image

docker buildx imagetools inspect \
  ghcr.io/altairalabs/omnia-operator:<version> \
  --format '{{json .Provenance}}'

Confirm a published file matches the attestation

Download and unpack the per-image documents, then export the attested package set:

curl -sSLO https://charts.altairalabs.ai/sbom/<version>/omnia-<version>.sboms.tar.gz
tar -xzf omnia-<version>.sboms.tar.gz
docker buildx imagetools inspect \
  ghcr.io/altairalabs/omnia-operator:<version> \
  --format '{{json .SBOM}}' \
  | jq -S '.["linux/amd64"].SPDX.packages | map({name, versionInfo}) | sort' \
  > attested.json

Export the same set from the published file and compare:

jq -S '.packages | map({name, versionInfo}) | sort' \
  omnia-operator.linux-amd64.spdx.json > published.json

diff attested.json published.json && echo "identical"

Rebuild the aggregate

Unpack the per-image documents into an empty directory:
Terminal window
```
mkdir sboms
tar -xzf omnia-<version>.sboms.tar.gz -C sboms/
```

Run the roll-up script from the repository checkout:

python3 hack/sbom-aggregate.py \
  --input-dir sboms/ \
  --version <version> \
  --output aggregate.spdx.json

Verify

Download the published aggregate and compare it with the rebuilt one, ignoring the two fields that differ on every run:

curl -sSLO https://charts.altairalabs.ai/sbom/<version>/omnia-<version>.aggregate.spdx.json

diff \
  <(jq -S 'del(.creationInfo.created, .documentNamespace)' aggregate.spdx.json) \
  <(jq -S 'del(.creationInfo.created, .documentNamespace)' omnia-<version>.aggregate.spdx.json) \
  && echo "identical"

creationInfo.created is a timestamp and documentNamespace carries a fresh UUID, so a rebuild never reproduces them.

Supply-chain evidence