← All tags · All resources · All guides

#sbom

1 resource and 1 guide tagged #sbom on ChangeGamer.

• AI Supply Chain Provenance: SBOMs, SLSA, and Artifact Signing for Agents and MCP Servers · Reference
  How CycloneDX AI/ML-BOM, SPDX AI profiles, SLSA build levels, and in-toto/Sigstore signing let an agent check what is actually inside a model, package, or MCP server — and how it was built — before trusting it.

Guides

• How to Verify Supply-Chain Provenance for AI Agent Dependencies · guide
  An operational playbook for three separate trust-boundary gates — package-install time, model-load time, and MCP-server-connect time — that turns SBOM and attestation formats into checks a pipeline can actually run, plus a fail-closed default for the dependency that carries neither.