The latest release series of BuildKit, v0.11, introduces support for build-time attestations and SBOMs, allowing publishers to create images with records of how the image was built. This makes it easier for you to answer common questions, like which packages are in the image, where the image was built from, and whether you can reproduce the same results locally.
This new data helps you make informed decisions about the security of the images you consume — without needing to do all the manual work yourself.
This new blog post discusses what attestations and SBOMs are, how to build images that contain SBOMs, and how to start analyzing the resulting data!