No dedicated repository. SBOM passports are the ingredient layer; blast-radius decisions and rehearsal live in BlastGuard.
Case 06 · Pattern
SBOM Integration
Supply-chain truth rides with the build: SBOM generation, attachment, vuln enrichment, and release gates turn provenance into a passport — not a quarterly PDF.
00
Evidence home
Pattern case — proof lives next door.
01
How it works
Every artifact gets an ingredient passport.
SBOM Integration by Andrey Lesnikov — stamp provenance in CI so promote decisions see ingredients, vulns, and evidence before release.
-
01
Generate in the pipeline
SBOMs are born with the build — not scraped weeks later when auditors ask uncomfortable questions.
-
02
Attach to the artifact
The passport travels with the image digest so later stages do not invent provenance from memory.
-
03
Enrich with vuln context
Findings are readable for humans: what broke policy and what to fix — not a raw CVE dump.
-
04
Gate the promote
No passport, no promote. Supply-chain visibility becomes a delivery control, not compliance theatre.
02
Evidence
From problem to proof.
How the system is framed, operated, and proven — not a slide deck summary.
01
Artifacts ship without a passport: SBOM is generated late, disconnected from promote gates, or treated as a quarterly PDF instead of a delivery control.
02
You already stamp provenance in CI and only need blast-radius decisions after a CVE lands. That is BlastGuard territory — correlate SBOM, CVE, VEX, runtime presence, and exposure into ALLOW / WARN / QUARANTINE / BLOCK.
03
BlastGuard predicts blast radius after ingredients are known. Policy as Code Guardrails turns passport failures into admission and promote decisions.
Constraints
CI/CD speed, artifact provenance, vulnerability context, policy gates, and developer-readable remediation feedback.
03
Related
Nearby systems.
BlastGuard
CVE scanners produce finding counts
Blast radius predicted before CVE count
Policy as Code Guardrails
Security and platform rules are often discovered only after deployment or during reviews
Standards enforced in CI, not slides
GitOps: Argo CD & Flux
Teams need a clear delivery model before GitOps becomes another layer of operational confusion
Delivery as explicit platform contracts
Available for meaningful infrastructure conversations