SBOM

Status: TODO

Generate a machine-readable SBOM for every release.

Recommended format: CycloneDX JSON.

Suggested tooling:

syft dir:/ -o cyclonedx-json > sbom.cdx.json

or generate from the built image/filesystem in CI.

Also keep:

• OS package list
• Go/application dependency list
• release artifact hashes
• vulnerability scan results

Do not manually maintain the SBOM if it can be generated from the release artifact.