---
title: "Publish what is in each release · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance
updated: 2026-10-20
licence: "All rights reserved"
---

# Publish what is in each release

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Make a software bill of materials for every release, and sign where and how the build was made.
- How: Generate the bill in a standard format such as CycloneDX or SPDX, with a tool such as Syft. Record build provenance as the SLSA framework describes, and sign the release with a tool such as Sigstore's cosign. Then you can answer at once whether a newly reported hole affects you. See also [handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period).
- Check: Each release has a bill of materials and a signature. Verifying the signature with the published key succeeds, and changing one byte of the release makes it fail.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance`.

- Previous: [Plan attacks before building](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/threat-model)
- Next: [Wait a few days before taking new releases](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)