The proposed attestation form is meant to help secure the software chain and formalizes the role of the SBOM as the first line of defense.

By rooter