---
title: "Use Trivy for the bill of materials and · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/sbom-and-signing
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use Trivy for the bill of materials and cosign to sign releases

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: STK-95
- Level: Recommended
- Chapter: [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)
- Rule: Write a CycloneDX bill of materials for every release image with Trivy, and sign the image and its bill with cosign in CI.
- Cost: Open source. Trivy and cosign are both Apache-2.0. Sigstore's public signing service and transparency log are free to use.
- How: The Trivy you already run for [scans](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy) also writes SPDX and CycloneDX files, so the bill needs no new tool. cosign 1.0 came out on 28 July 2021, and 3.1.4 shipped on 20 October 2026. It belongs to Sigstore, an OpenSSF project, and its repository had about 6,400 stars in October 2026. Keyless signing uses the CI job's identity, so no private key can leak. Each signature goes into Sigstore's public log, which shows the repository name. Private projects sign with a key held in their secrets store instead. Pin cosign by digest, as the Trivy rule does. What to publish is in [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance). Verify before each deploy, as [Build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/build-in-ci-and-verify) says. Choose something else when your registry already signs with Notation from the Notary Project, and keep one signer for every image.
- Check: Each release image has a CycloneDX attestation. `cosign verify` with the expected CI identity passes, and it fails for an image pushed from a laptop.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
IMAGE=registry.example.com/shop@sha256:0000000000000000000000000000000000000000000000000000000000000000
trivy image --format cyclonedx --output sbom.cdx.json "$IMAGE"
cosign sign --yes "$IMAGE"
cosign attest --yes --type cyclonedx --predicate sbom.cdx.json "$IMAGE"
```

### Shell example 2

```sh
cosign verify \
  --certificate-identity-regexp '^https://github.com/example/shop/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  "$IMAGE"
```

## Sources

- [Trivy SBOM](https://trivy.dev/docs/latest/supply-chain/sbom/)
- [Sigstore](https://openssf.org/projects/sigstore/)
- [SLSA specification](https://slsa.dev/spec/v1.2/)

## Related rules

- [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/immutable-releases) in Engineering
- [Use Trivy to scan images and dependencies](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy) in Software choices
- [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance) in Security testing
- [Build releases only in CI and verify them before deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/build-in-ci-and-verify) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/sbom-and-signing">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use Trivy to scan images and dependencies](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy)
- Next: [Use a settings file for flags and Unleash when flags need targeting](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/feature-flags)
- [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)