Skip to content
chant Docs Demo

Require SBOMs and Provenance

llms.txt lists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Read https://intentius.io/chant/guide/security-supply-chain/.
Add `supply-chain` to `security` in `chant.workspace.json`, run `npx chant workspace check`, and fix the `WSP162` findings that are file changes: an `sbom` entry, a `generate-sbom` or `verify` step, `--require-provenance` on the publish job.
Open a pull request with the changes, and list the findings left for a person.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Every security feature in chant is off until a workspace turns it on (#4168). A group turns on a set of them at once, and each feature still turns on alone; the security features reference lists them all.

Under supply-chain:

  • A publish target with no SBOM source is refused (publish-sbom-missing). Without the group it publishes without one.
  • A publish with no OIDC token warns that what it publishes carries no provenance. Without the group, provenance is only a field in the plan. --require-provenance refuses instead, with or without the group.

An SBOM comes from the file a target’s sbom names, else from the lockfile nearest the member: package-lock.json, pom.xml or Cargo.lock. A member whose directory holds a Cargo.toml reads Cargo.lock first.

Opt in

Section titled “Opt in”

Add the group to security in chant.workspace.json, at the top level for every member or on one member for that member only. A member’s list adds to the top-level one.

"security": ["supply-chain"]

A declaration that uses security sets minReader to 0.124.33 or newer.

Fill the gaps

Section titled “Fill the gaps”

chant workspace check reports what the group still lacks as WSP162 warnings:

CodeWhat to do
security-sbom-disabledRemove sbom: false from the publish target.
security-sbom-unsourcedPoint sbom at the SPDX or CycloneDX file the build writes, or commit the member’s lockfile.
security-publish-no-provenancePass --require-provenance in the publish job, which runs in CI with an OIDC token.
security-component-no-sbomAdd a generateSbom step to the member’s components.
security-component-no-verifyAdd a verify step before the deploy steps.

chant