Docker SBOM attestations: build, inspect and retain the evidence

The concrete problem: Docker meets BuildKit

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c11 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns attestation into a reviewable decision point with a named input and a retained output. To test Docker, fixture docker-sbom-attestations-workflow-c11 contains both an allowed state and a rejected state; rejection must occur before any change attributed to BuildKit. Operations then observes the transition between BuildKit and SBOM, while security checks that SPDX receives neither implicit authority nor unnecessary data.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c12 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. If the SPDX verification fails, rollback restores the configuration around attestation, replays docker-sbom-attestations-workflow-c12, and compares the new state with the control evidence from Docker. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to BuildKit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by SBOM and attestation: anything not demonstrated by scenario docker-sbom-attestations-workflow-c12 is labeled as a limitation or inference, never promoted to fact.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c13 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns BuildKit into a reviewable decision point with a named input and a retained output. To test SBOM, fixture docker-sbom-attestations-workflow-c13 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SPDX. Operations then observes the transition between SPDX and attestation, while security checks that Docker receives neither implicit authority nor unnecessary data.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c14 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. If the Docker verification fails, rollback restores the configuration around BuildKit, replays docker-sbom-attestations-workflow-c14, and compares the new state with the control evidence from SBOM. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SPDX, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by attestation and BuildKit: anything not demonstrated by scenario docker-sbom-attestations-workflow-c14 is labeled as a limitation or inference, never promoted to fact.

Trust boundaries around SBOM

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c21 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. The conclusion stays bounded by SBOM and attestation: anything not demonstrated by scenario docker-sbom-attestations-workflow-c21 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns Docker into a reviewable decision point with a named input and a retained output. To test BuildKit, fixture docker-sbom-attestations-workflow-c21 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SBOM.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c22 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. Operations then observes the transition between SPDX and attestation, while security checks that Docker receives neither implicit authority nor unnecessary data. If the attestation verification fails, rollback restores the configuration around Docker, replays docker-sbom-attestations-workflow-c22, and compares the new state with the control evidence from BuildKit. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SBOM, a concrete condition, and evidence instead of a generic assurance.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c23 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. The conclusion stays bounded by attestation and BuildKit: anything not demonstrated by scenario docker-sbom-attestations-workflow-c23 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SBOM into a reviewable decision point with a named input and a retained output. To test SPDX, fixture docker-sbom-attestations-workflow-c23 contains both an allowed state and a rejected state; rejection must occur before any change attributed to attestation.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c24 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. Operations then observes the transition between Docker and BuildKit, while security checks that SBOM receives neither implicit authority nor unnecessary data. If the BuildKit verification fails, rollback restores the configuration around SBOM, replays docker-sbom-attestations-workflow-c24, and compares the new state with the control evidence from SPDX. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to attestation, a concrete condition, and evidence instead of a generic assurance.

Prepare the starting state and prerequisites

The starting point is not a feature; it is an observable decision boundary.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c31 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SBOM, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by SPDX and Docker: anything not demonstrated by scenario docker-sbom-attestations-workflow-c31 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns BuildKit into a reviewable decision point with a named input and a retained output.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c32 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. To test SPDX, fixture docker-sbom-attestations-workflow-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to attestation. Operations then observes the transition between attestation and Docker, while security checks that BuildKit receives neither implicit authority nor unnecessary data. If the Docker verification fails, rollback restores the configuration around BuildKit, replays docker-sbom-attestations-workflow-c32, and compares the new state with the control evidence from SBOM.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c33 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to attestation, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Docker and SBOM: anything not demonstrated by scenario docker-sbom-attestations-workflow-c33 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SPDX into a reviewable decision point with a named input and a retained output.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c34 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. To test Docker, fixture docker-sbom-attestations-workflow-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to BuildKit. Operations then observes the transition between BuildKit and SBOM, while security checks that SPDX receives neither implicit authority nor unnecessary data. If the SBOM verification fails, rollback restores the configuration around SPDX, replays docker-sbom-attestations-workflow-c34, and compares the new state with the control evidence from attestation.

1. Step 1 — Configure Docker, run verification docker-sbom-attestations-workflow-step-1, and retain the observable result before continuing.
2. Step 2 — Configure BuildKit, run verification docker-sbom-attestations-workflow-step-2, and retain the observable result before continuing.
3. Step 3 — Configure SBOM, run verification docker-sbom-attestations-workflow-step-3, and retain the observable result before continuing.
4. Step 4 — Configure SPDX, run verification docker-sbom-attestations-workflow-step-4, and retain the observable result before continuing.
5. Step 5 — Configure attestation, run verification docker-sbom-attestations-workflow-step-5, and retain the observable result before continuing.
6. Step 6 — Configure Docker, run verification docker-sbom-attestations-workflow-step-6, and retain the observable result before continuing.

Execute the procedure and observe the result

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c41 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. If the Docker verification fails, rollback restores the configuration around BuildKit, replays docker-sbom-attestations-workflow-c41, and compares the new state with the control evidence from SBOM. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SPDX, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by attestation and BuildKit: anything not demonstrated by scenario docker-sbom-attestations-workflow-c41 is labeled as a limitation or inference, never promoted to fact.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c42 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SPDX into a reviewable decision point with a named input and a retained output. To test attestation, fixture docker-sbom-attestations-workflow-c42 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Docker. Operations then observes the transition between Docker and BuildKit, while security checks that SBOM receives neither implicit authority nor unnecessary data.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c43 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. If the SBOM verification fails, rollback restores the configuration around SPDX, replays docker-sbom-attestations-workflow-c43, and compares the new state with the control evidence from attestation. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to Docker, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by BuildKit and SPDX: anything not demonstrated by scenario docker-sbom-attestations-workflow-c43 is labeled as a limitation or inference, never promoted to fact.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c44 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns Docker into a reviewable decision point with a named input and a retained output. To test BuildKit, fixture docker-sbom-attestations-workflow-c44 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SBOM. Operations then observes the transition between SBOM and SPDX, while security checks that attestation receives neither implicit authority nor unnecessary data.

Failure modes, signals, and diagnosis

The hard part appears when the happy path meets authorization, failures, and operational constraints.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c51 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. Operations then observes the transition between Docker and BuildKit, while security checks that SBOM receives neither implicit authority nor unnecessary data. If the BuildKit verification fails, rollback restores the configuration around SBOM, replays docker-sbom-attestations-workflow-c51, and compares the new state with the control evidence from SPDX. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to attestation, a concrete condition, and evidence instead of a generic assurance.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c52 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. The conclusion stays bounded by BuildKit and SPDX: anything not demonstrated by scenario docker-sbom-attestations-workflow-c52 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns attestation into a reviewable decision point with a named input and a retained output. To test Docker, fixture docker-sbom-attestations-workflow-c52 contains both an allowed state and a rejected state; rejection must occur before any change attributed to BuildKit.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c53 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. Operations then observes the transition between SBOM and SPDX, while security checks that attestation receives neither implicit authority nor unnecessary data. If the SPDX verification fails, rollback restores the configuration around attestation, replays docker-sbom-attestations-workflow-c53, and compares the new state with the control evidence from Docker. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to BuildKit, a concrete condition, and evidence instead of a generic assurance.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c54 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. The conclusion stays bounded by SPDX and Docker: anything not demonstrated by scenario docker-sbom-attestations-workflow-c54 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns BuildKit into a reviewable decision point with a named input and a retained output. To test SBOM, fixture docker-sbom-attestations-workflow-c54 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SPDX.

Progressive rollout and rollback

A robust implementation separates what the model proposes from what the application authorizes and verifies.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c61 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. To test Docker, fixture docker-sbom-attestations-workflow-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to BuildKit. Operations then observes the transition between BuildKit and SBOM, while security checks that SPDX receives neither implicit authority nor unnecessary data. If the SBOM verification fails, rollback restores the configuration around SPDX, replays docker-sbom-attestations-workflow-c61, and compares the new state with the control evidence from attestation.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c62 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to BuildKit, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by SBOM and attestation: anything not demonstrated by scenario docker-sbom-attestations-workflow-c62 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns Docker into a reviewable decision point with a named input and a retained output.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c63 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. To test SBOM, fixture docker-sbom-attestations-workflow-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SPDX. Operations then observes the transition between SPDX and attestation, while security checks that Docker receives neither implicit authority nor unnecessary data. If the attestation verification fails, rollback restores the configuration around Docker, replays docker-sbom-attestations-workflow-c63, and compares the new state with the control evidence from BuildKit.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c64 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SPDX, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by attestation and BuildKit: anything not demonstrated by scenario docker-sbom-attestations-workflow-c64 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SBOM into a reviewable decision point with a named input and a retained output.

Production decision criteria

The starting point is not a feature; it is an observable decision boundary.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c71 starts at Docker and treats BuildKit as an explicit boundary rather than an implicit assumption. The first control requires SBOM to emit an observable result before SPDX can trigger the intended effect around attestation. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns Docker into a reviewable decision point with a named input and a retained output. To test BuildKit, fixture docker-sbom-attestations-workflow-c71 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SBOM. Operations then observes the transition between SBOM and SPDX, while security checks that attestation receives neither implicit authority nor unnecessary data.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c72 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. If the attestation verification fails, rollback restores the configuration around Docker, replays docker-sbom-attestations-workflow-c72, and compares the new state with the control evidence from BuildKit. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SBOM, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by SPDX and Docker: anything not demonstrated by scenario docker-sbom-attestations-workflow-c72 is labeled as a limitation or inference, never promoted to fact.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c73 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SBOM into a reviewable decision point with a named input and a retained output. To test SPDX, fixture docker-sbom-attestations-workflow-c73 contains both an allowed state and a rejected state; rejection must occur before any change attributed to attestation. Operations then observes the transition between attestation and Docker, while security checks that BuildKit receives neither implicit authority nor unnecessary data.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c74 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. If the BuildKit verification fails, rollback restores the configuration around SBOM, replays docker-sbom-attestations-workflow-c74, and compares the new state with the control evidence from SPDX. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to attestation, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Docker and SBOM: anything not demonstrated by scenario docker-sbom-attestations-workflow-c74 is labeled as a limitation or inference, never promoted to fact.

Controls that remain after launch

A production design should make it clear who decides, what evidence is available, and what can be rolled back.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c81 starts at BuildKit and treats SBOM as an explicit boundary rather than an implicit assumption. The first control requires SPDX to emit an observable result before attestation can trigger the intended effect around Docker. The conclusion stays bounded by SPDX and Docker: anything not demonstrated by scenario docker-sbom-attestations-workflow-c81 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns BuildKit into a reviewable decision point with a named input and a retained output. To test SBOM, fixture docker-sbom-attestations-workflow-c81 contains both an allowed state and a rejected state; rejection must occur before any change attributed to SPDX.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c82 starts at SBOM and treats SPDX as an explicit boundary rather than an implicit assumption. The first control requires attestation to emit an observable result before Docker can trigger the intended effect around BuildKit. Operations then observes the transition between attestation and Docker, while security checks that BuildKit receives neither implicit authority nor unnecessary data. If the Docker verification fails, rollback restores the configuration around BuildKit, replays docker-sbom-attestations-workflow-c82, and compares the new state with the control evidence from SBOM. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to SPDX, a concrete condition, and evidence instead of a generic assurance.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c83 starts at SPDX and treats attestation as an explicit boundary rather than an implicit assumption. The first control requires Docker to emit an observable result before BuildKit can trigger the intended effect around SBOM. The conclusion stays bounded by Docker and SBOM: anything not demonstrated by scenario docker-sbom-attestations-workflow-c83 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Generate an SPDX SBOM during BuildKit, inspect it locally and retain it with the image release record. It turns SPDX into a reviewable decision point with a named input and a retained output. To test attestation, fixture docker-sbom-attestations-workflow-c83 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Docker.

In “Docker SBOM attestations: build, inspect and retain the evidence”, scenario docker-sbom-attestations-workflow-c84 starts at attestation and treats Docker as an explicit boundary rather than an implicit assumption. The first control requires BuildKit to emit an observable result before SBOM can trigger the intended effect around SPDX. Operations then observes the transition between BuildKit and SBOM, while security checks that SPDX receives neither implicit authority nor unnecessary data. If the SBOM verification fails, rollback restores the configuration around SPDX, replays docker-sbom-attestations-workflow-c84, and compares the new state with the control evidence from attestation. This detail makes “Docker SBOM attestations: build, inspect and retain the evidence” reviewable because each operational statement points to Docker, a concrete condition, and evidence instead of a generic assurance.

Operational checklist

• The control around Docker has an input, a rule, a rejection behavior, and evidence.
• The control around BuildKit has an input, a rule, a rejection behavior, and evidence.
• The control around SBOM has an input, a rule, a rejection behavior, and evidence.
• The control around SPDX has an input, a rule, a rejection behavior, and evidence.
• The control around attestation has an input, a rule, a rejection behavior, and evidence.