[aledbf]

S2 of the supply-chain plan (PR 8 in the table): the deterministic CycloneDX 1.6 library and command the three repositories write their SBOMs with.

• sbom (importable) on cyclonedx-go v0.12.0:
  • Kinds: Go (build info: the main module at the release's version, its modules with their go.sum hash, replacements as compiled, and stdlib), Apko, Dpkg, Apk (-only is what ships; the rest is formulation), Pnpm (runtime dependencies only, never dev), Pins (versions.yaml), and File.
  • Combining and checking: Merge nests BOMs under a subject; Check refuses an empty version, (devel), or a component with neither a purl nor a hash.
  • Determinism: components are sorted, the serial is a UUIDv8 of the subject, and the timestamp comes only from SOURCE_DATE_EPOCH.
• cmd/sbom: one subcommand per kind, plus merge and check.
• attestgate.Gate.RequireSBOM: an upload also needs an earlier cosign attest-blob --type cyclonedx. It is off, so bumping go-tools turns no repository red.
• Run on real inputs (spin's pnpm lock, spin-ami's apko lock, a Go binary): each BOM passes check, and pnpm gives the same bytes on a second run.

mutate: 135 refused, 0 survived.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}