Software supply chain

Provenance, not promises

Every artefact that runs in production is reproducible, signed, and accompanied by an SBOM and an in-toto attestation. If we cannot prove where a binary came from, it does not deploy.

SLSA level

Verified by independent rebuild

Unsigned images

Cluster admission policy

Reproducible LTM

100%

Build digest matches on rebuild

OpenSSF Scorecard

≥ 8.0

Across all critical dependencies

Control register

Control	Standard	Status	Evidence
Per-release SBOM (CycloneDX 1.5)	NTIA / EU CRA	Published for every release	Downloadable from /attestations and signed by build key
Signed container images	Sigstore Cosign · keyless OIDC	Enforced at admission	Unsigned images rejected by cluster admission policy
Reproducible builds	SLSA v1.0	SLSA level 3	Independent rebuild matches digest for 100% of LTM releases
Build provenance (in-toto attestation)	in-toto v1.0	Attached to every artefact	Verifiable via cosign verify-attestation
Dependency review	OpenSSF Scorecard	≥ 8.0 across critical deps	Weekly scorecard report under /open-metrics
Known-vuln gate	OSV · Trivy	High/Critical: block merge	CI required check; overrides require Security sign-off
Maintainer 2FA + signed commits	GitHub policy	Enforced org-wide	Org audit log, reviewed quarterly
Internal registry	Private OCI + npm mirror	All deps proxied through mirror	No direct public registry pulls from production builds
Third-party penetration test	CREST-certified vendor	Annual + on major change	Letter of attestation in /assurance and data room

Verifying yourselves

Pull the SBOM for any release from /attestations.
Verify the signature: cosign verify --certificate-identity-regexp ‘.+admetricai.*’ ghcr.io/admetricai/<image>@<digest>
Verify the in-toto attestation matches the digest you pulled.
Rebuild from the tag and confirm the digest matches; we publish the build instructions per release.

If any step fails, please notify security@admetricai.app — we treat reproducibility regressions as severity-1 incidents.