Agent WranglersSupply chain and setup Recommended
Publish what is in each release
Make a software bill of materials for every release, and sign where and how the build was made.
How to do it
Generate the bill in a standard format such as CycloneDX or SPDX, with a tool such as Syft. Record build provenance as the SLSA framework describes, and sign the release with a tool such as Sigstore's cosign. Then you can answer at once whether a newly reported hole affects you. See also handle vulnerabilities for the whole support period.
How to check
Each release has a bill of materials and a signature. Verifying the signature with the published key succeeds, and changing one byte of the release makes it fail.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance.