feat(build): publish OCI SBOM and provenance attestations - #2836
Merged
alangou merged 2 commits intoAug 27, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
alangou
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
August 20, 2026 12:20
Copy link
Copy Markdown
|
🌿 Preview your docs: https://nvidia-preview-pr-2836.docs.buildwithfern.com/openshell |
Sorry, something went wrong.
Copy link
Copy Markdown
|
Label test:e2e applied for 996f6de. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes. |
Sorry, something went wrong.
alangou
force-pushed
the
alangou/docker-images-sboms-as-oci-artifacts
branch
from
996f6de to
7f81fb7
Compare
August 25, 2026 10:04
Copy link
Copy Markdown
Contributor
Author
|
Output can be verified for the docker image that was created in this PR $ docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121
Name: ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121
MediaType: application/vnd.oci.image.index.v1+json
Digest: sha256:49d835709c3deff8a0d0578149ec9346baa2df8e4e21525c6f8e6fa04470000a
Manifests:
Name: ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121@sha256:535e20ef48a644ad6b9bdd54dbfc75d10234ce6a23ae48c4ea6861e871368c7d
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/amd64
Name: ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121@sha256:1d480ffcf9c5f3179c53c75db1db3243069be426fe039f1a682404efc76b0f5c
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: unknown/unknown
Annotations:
vnd.docker.reference.digest: sha256:535e20ef48a644ad6b9bdd54dbfc75d10234ce6a23ae48c4ea6861e871368c7d
vnd.docker.reference.type: attestation-manifest
Name: ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121@sha256:2ad4ca0e127b97045ad2e4dd8047e19c5375c20284cb36e997d398ab6cc31367
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/arm64
Name: ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121@sha256:787d2e4a2f3fb7c69072c2c6e7d53535bd610e96c9c41a61beb520c1ca6ef159
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: unknown/unknown
Annotations:
vnd.docker.reference.type: attestation-manifest
vnd.docker.reference.digest: sha256:2ad4ca0e127b97045ad2e4dd8047e19c5375c20284cb36e997d398ab6cc31367
And to inspect the sbom docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:7f81fb75dc76827dd05462d7a50b2861a3125121 --format '{{ json .SBOM }}'
|
Sorry, something went wrong.
alangou
force-pushed
the
alangou/2686-feat-embed-linked-rust-dependency-tree-cargo-auditable-in-release-binaries
branch
from
158b724 to
b7d6ac7
Compare
August 25, 2026 13:06
Base automatically changed from
alangou/2686-feat-embed-linked-rust-dependency-tree-cargo-auditable-in-release-binaries
to
main
August 25, 2026 14:49
elezar
reviewed
Aug 25, 2026
Comment thread
.github/workflows/rust-native-build.yml
elezar
reviewed
Aug 25, 2026
Comment thread
.github/workflows/rust-native-build.yml
alangou
force-pushed
the
alangou/docker-images-sboms-as-oci-artifacts
branch
2 times, most recently
from
2b77640 to
3362af3
Compare
August 26, 2026 14:37
elezar
previously approved these changes
Aug 27, 2026
Signed-off-by: Adrien Langou <alangou@nvidia.com>
alangou
force-pushed
the
alangou/docker-images-sboms-as-oci-artifacts
branch
from
3362af3 to
706db6b
Compare
August 27, 2026 14:06
Comment thread
.github/workflows/docker-build.yml
Fixed
Signed-off-by: Adrien Langou <alangou@nvidia.com>
alangou
force-pushed
the
alangou/docker-images-sboms-as-oci-artifacts
branch
from
706db6b to
a41969a
Compare
August 27, 2026 14:32
alangou
enabled auto-merge
August 27, 2026 14:37
SDAChess
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Publish per-platform SPDX SBOM and minimal SLSA provenance as OCI artifacts for pushed gateway and supervisor images. This PR is stacked on #2734 so release image SBOMs can include the cargo-auditable Rust dependencies introduced there.
Related Issue
Part of #2686.
Stacked on #2734.
Changes
Testing
Checklist