Software bill of materials

Rune Gurd SBOMs

Each Rune Guard release is built with CycloneDX 1.6 JSON SBOMs, generated deterministically and covered by the release’s signatures.

Release files: manifest.json, manifest.sig, SHA256SUMS and the release signers.

Rune Box ships its own SBOM with each release.

The SBOMs each Rune Guard release carries: what each lists, where it is published and how it is signed
SBOM	What it lists	Published	Signed	Download
`agent.cdx.json`	The runeward-guard crate, which every agent package’s binaries come from, and every crate it builds with, with the crates.io checksums from Cargo.lock.	The release’s public directory; the Linux package repository, which will also carry it, isn’t published yet.	The release key (`agent.cdx.json.sig`); also the Linux release subkey (`agent.cdx.json.asc`).	SBOM · signature
`cloud-image.cdx.json`	The Guard Cloud image: its Debian packages and files, and the guard-cloud binary’s crates.	The release’s public directory, and the container registry, attached to the image digest.	The release key (`cloud-image.cdx.json.sig`); its sha256 is in the signed manifest.	SBOM · signature
`edge-image.cdx.json`	The edge image: Caddy and the Console build.	The release’s public directory, and the container registry, attached to the edge image digest.	The release key (`edge-image.cdx.json.sig`); its sha256 is in the signed manifest.	SBOM · signature
`cloud-crates.cdx.json`	The guard-cloud crates alone, which are also merged into the Cloud image SBOM.	The release’s public directory.	The release key (`cloud-crates.cdx.json.sig`); its sha256 is in the signed manifest.	SBOM · signature

Verify a release

Download the release’s files and the release signers, compare the key fingerprints with the ones Runeward Labs publishes, then check each signature with OpenSSH 8.1 or later. The staging@runeward-release identity signs staging releases. Every check must print Good "runeward-release" signature, and sha256sum -c SHA256SUMS must pass.

ssh-keygen -Y verify -f release-signers -I staging@runeward-release \
  -n runeward-release -s agent.cdx.json.sig < agent.cdx.json