# Attestation articles

## Pages

- [Announcing sbomify-action v26.8.0: The One That Went on a Diet](https://sbomify.com/2026/08/25/announcing-sbomify-action-v26-8-0-the-one-that-went-on-a-diet/) (2026-08-25): sbomify-action v26.8.0 cuts the container image from 515MB to 106MB by fetching verified, attested tool bundles on demand, ends silent SBOM quality downgrades, adds git submodule support, and introduces Clearly Cached, a caching proxy that makes ClearlyDefined license data actually usable from CI.
- [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/) (2026-01-23): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges.
- [GitHub Action module with Attestation](https://sbomify.com/2024/10/31/github-action-update-and-attestation/) (2024-10-31): New features in sbomify's GitHub Action including Dart lockfile support, Docker image SBOMs, NTIA enrichment, and SLSA build provenance attestation.
- [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/) (2024-08-14): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity.

---

From sbomify: https://sbomify.com/tags/attestation/