SBOM Signing and Verification Reference

[yoshi-i]

[File URL / Relevant Section Number]
https://github.com/OpenChain-Project/SBOM-wg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/chapters/03-guidelines-to-enhance-sbom-document-quality.md

[Previous Text]
A digital signature of the SBOM Document SHOULD be provided in order to guarantee its integrity.

[Subject Text]
3.6.1 Verification and reference material

[Following Text]
Sigstore: https://www.sigstore.dev/

[Comments / Suggested Changes]
I documented my findings on SBOM signing and verification here:
https://github.com/shiftleftcyber/sbom-signing-best-practices
This focuses specifically on the SBOM file hash computation (used for signing / verification).  Feel free to include this in the guide if relevant.

[Comments from]
Jason Smith

[Dates]
2026-04-24

[NorioKobota]

We will include it as a reference in the guide, as it provides valuable guidance on SBOM file hash computation, signing, and verification practices.

[NorioKobota]

will replace from "Sigstore: https://www.sigstore.dev/" to "SBOM Signing Best Practices: https://github.com/shiftleftcyber/sbom-signing-best-practices"