Attestations

BuildKit supports creating and attaching attestations to build artifacts. Generated attestations use the in-toto attestation format.

The currently supported attestation types are:

• SBOMs
• SLSA Provenance

Upon generation, attestations are attached differently to the export result:

• For the image, oci and docker exporters, attestations are exported using the attached attestation storage.
• For the local and tar exporters, attestations are written to separate files within the output directory.