BuildKit can attach SBOM and SLSA provenance attestations with --sbom and --provenance. Generating them is easy. I've yet to meet a team that rejects deploys based on them. Who's closing the loop?
We do, partially. Admission controller checks that:
1. The image has a provenance attestation. 2. The builder identity is our CI, not a laptop. 3. The source repo is in an allowlist.
We do *not* yet check SBOM contents at admission — that's done asynchronously and creates tickets. Blocking deploys on CVE scans caused too many emergency overrides, which teaches everyone to override.
Async for SBOM, sync for provenance. That split sounds right.
mode=max provenance leaks build args, by the way. Check before you publish public images.
