---
id: w6/m6/t002
title: Container supply chain — image signing + SBOM in CI
worker: worker6
status: done
estimate: 45m
depends_on: []
---

## Objective

Add image signing (cosign) and SBOM generation to the build/push CI step for both the `lego/` product image and CNB-built tenant images.

## Context

- Repo-wide grep for `cosign`/image signing/SBOM/provenance returns zero real hits today — no supply-chain attestation exists anywhere.
- `lego/` image build: `.github/workflows/deploy.yml` / `app-cluster.yml` (build + push steps).
- Tenant image builds: in-cluster BuildKit via CNB (`docs/ADR004-deployment.md`, `w1/m5`) — pushed to Zot (`bex-registry`).

## Steps

1. Add cosign keyless signing (OIDC/Sigstore) to the CI step that builds/pushes the `lego/` image.
2. Generate and attach an SBOM (e.g. `syft`) to that image.
3. For CNB tenant-image builds, evaluate whether signing/SBOM is feasible at build time (BuildKit Job in-cluster) and either wire it in or document why it's deferred.
4. Document the signing/verification flow (how to verify a pulled image) in `docs/ADR028-security-review.md` (t007).

## Files

- `.github/workflows/deploy.yml`, `.github/workflows/app-cluster.yml`
- `lego/Dockerfile`
- operator's build-Job construction code (in-cluster BuildKit path)

## Acceptance criteria

- [ ] CI produces a cosign-signed `lego/` image on every build.
- [ ] An SBOM is generated and attached/published alongside the image.
- [ ] Tenant-image (CNB) signing/SBOM is either implemented or explicitly deferred with a documented reason.

## Out of scope

- Enforcing signature verification at deploy/admission time (a follow-up, not this task).
