Repository navigation
Generate release SBOMs #12818
Description
Activity
- added a parent issue
on Aug 24, 2026 Implementation PR: #12869 (draft), submitted as the top layer of stack #12738 above #12828.
The implementation and local validation are complete: the real GoReleaser snapshot produced seven valid SPDX CLI SBOMs with no extra checksum sidecars, and deterministic Buildx fixtures cover per-platform image attestations. Keep the PR draft until the full SBOM set is observed on one RC draft release.
- added 4 commits that reference this issue
on Aug 28, 2026 - added a commit that references this issue
on Sep 17, 2026 - added 2 commits that reference this issue
on Oct 6, 2026
Metadata
Metadata
Assignees
Labels
No labels
Parent: #11777
Implementation plan: PR 14 — SBOM generation
Design: GoReleaser Release Lifecycle
Implementation PR: Not yet created.
Scope
Enable GoReleaser's native syft integration for raw CLI binary and production image SBOMs. Publish SBOMs as additive release assets and document their format and discovery path without changing existing asset contracts.
Acceptance criteria