Documentation index

Release and SBOM Verification

Customer Acceptance Rule

Install only an authorized release that includes a versioned manifest, cryptographic hashes, pinned container image digest, release notes, and machine-processable SBOM artifacts. Treat missing or inconsistent release evidence as a failed acceptance check.

Expected Release Evidence

• CycloneDX JSON and SPDX JSON SBOMs.
• Product and component names, versions, suppliers, unique identifiers, hashes, licenses, dependency relationships, creation timestamp, and generating tool.
• Explicit treatment of unknown values rather than silent omission.
• Release package hash manifest and container image digest.
• SBOM attestation identifying the release and generation method.
• Vulnerability scan results and VEX or equivalent status information when applicable.
• Release notes describing security-relevant changes and supported upgrade paths.

Verification

1. Obtain artifacts through the approved customer channel.
2. Verify the archive hash before extraction.
3. Verify the pulled container digest matches the release manifest.
4. Confirm the SBOM identifies the same product version and image.
5. Scan the SBOM and image with customer-approved tooling.
6. Review critical and high findings, exploitability, compensating controls, and supplier disposition.
7. Record customer acceptance or rejection with accountable owners.
8. Retain the verified release evidence with the deployment record.

Update Control

Repeat verification for every Workbench, PostgreSQL, reverse-proxy, base-image, or operating-system update. Do not approve an update solely because a mutable image tag changed successfully.