Skip to main content

Signed SBOMs & Build Provenance

Every covered RPM and DEB in the GetPageSpeed repositories ships with a signed Software Bill of Materials (SBOM) and a build-provenance attestation, included with the Ultra plan (Enterprise inherits).

What you get

For each covered package:

  • SPDX SBOM (<package>.spdx.json) — the ISO/IEC 5962 standard bill of materials listing package contents, for supply-chain compliance reviews and vulnerability tooling.
  • Provenance attestation (<package>.provenance.json) — an in-toto/SLSA v1 statement (self-attested, SLSA Build L1) recording the package digest, publishing channel, and build metadata.
  • Detached GPG signatures (.asc) for both files, made with the same repository signing keys your systems already trust.

Fetching attestations

Attestations mirror the package path under /sbom/ on the repository host. For a package at:

https://extras.getpagespeed.com/redhat/9/x86_64/RPMS/<package>.rpm

fetch:

https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.spdx.json
https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.spdx.json.asc
https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.provenance.json
https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.provenance.json.asc

Access uses the same IP authorization as the package repositories — no extra credentials needed. Requests from IPs without an Ultra or Enterprise subscription receive 403.

Verifying signatures

Attestations are signed with the same key that signs the repository metadata of the package’s own channel, exported at repodata/repomd.xml.key:

curl -s https://extras.getpagespeed.com/redhat/9/x86_64/repodata/repomd.xml.key | gpg --import
curl -O https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.spdx.json
curl -O https://extras.getpagespeed.com/sbom/redhat/9/x86_64/RPMS/<package>.rpm.spdx.json.asc
gpg --verify <package>.rpm.spdx.json.asc <package>.rpm.spdx.json

Using the SBOM

Vulnerability scanning — the SPDX file works directly with the common scanners, no installation of the package required:

grype sbom:<package>.rpm.spdx.json
trivy sbom <package>.rpm.spdx.json
osv-scanner --sbom=<package>.rpm.spdx.json

SBOM management platforms — import the SPDX JSON into Dependency-Track or any platform that accepts SPDX 2.x, and track the components of your NGINX stack alongside the rest of your software inventory.

Compliance evidence — archive the signed SBOM + provenance pair as supplier evidence for EO 14028 / NIST SSDF software supply-chain requirements and security questionnaires. The provenance statement identifies the package digest, publishing channel, and build metadata; the detached signatures prove both documents came from GetPageSpeed.

Coverage

Initial coverage: NGINX-MOD and NGINX module packages for Enterprise Linux 9/10 (x86_64) and Ubuntu 24.04 LTS (amd64). Coverage expands across the catalog; new package publishes generate attestations automatically.

Questions about SBOM formats, VEX statements, or security-questionnaire support for your organization? Contact us about Enterprise.

Recent Posts