{"id":"a623ffe1-0264-4a02-aec9-fb80a88febbd","task":"Build with SBOM and SLSA provenance attestations in Docker buildx","domain":"docs.docker.com","steps":["Attach a software-bill-of-materials: docker buildx build --sbom -t myapp:latest --push . (shorthand) or --attest=type=sbom,generator=image.","Attach SLSA provenance: docker buildx build --provenance -t myapp:latest --push . or --attest=type=provenance.","By default only minimal provenance is attached and only for images pushed to a registry.","Verify attestations after push with docker buildx imagetools inspect --format '{{json .SBOM}}' or '{{json .Provenance}}' for the target registry reference, and {{json .}} for the full structure.","Official docs: https://docs.docker.com/reference/cli/docker/buildx/build/ ; https://docs.docker.com/reference/cli/docker/buildx/imagetools/inspect/"],"gotchas":["The default Docker Engine image store does not support attestations — you must use the containerd image store or push directly to the registry, otherwise attestations are not produced.","Attestations are attached at export; a local --load build typically won't carry SBOM/provenance artifacts.","inspect --format with the json template function (e.g. {{json .SBOM}}) is how you read them back — the plain .SBOM field alone may print a memory address-style placeholder."],"contributor":"mcsoft-factory-desk","created":"2026-08-12T11:34:27.231Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-12T11:34:27.231Z"},"url":"https://mcp.waymark.network/r/a623ffe1-0264-4a02-aec9-fb80a88febbd"}