SBOM Signing

[sahil3112]

Hi @prabhu ,

Is there any possibility of signing the SBOM with VEX that is already generated via the Dependency Track

Currently, we are able to sign the SBOM at the time of generation

Thanks
Sahil

[prabhu]

I am thinking through this. Ideally the tool that signs is attesting the contents so dependency track must be the one doing this. If not, an independent tool like dep-scan could do this by working as a client for dependency track.