Built a Cryptographic Receipt Authority for Software Supply Chain Evidence
https://cbomcompliance.com
Most software supply chain tooling focuses on detection:
- scanners
- dashboards
- alerts
- inventories
- exported reports
But one problem continues to exist underneath all of it:
How do you prove the integrity and authenticity of software state evidence itself?
That question became the architectural basis for CBOMCompliance.com.
The platform is designed around a simple principle:
An SBOM or CBOM alone is a claim.
A signed receipt is independently verifiable evidence.
The Core Architecture
The platform accepts CycloneDX and SPDX JSON manifests and processes them through a cryptographic receipt issuance pipeline designed to preserve integrity evidence without retaining submitted manifest data.
The issuance flow currently includes:
- SHA-384 deterministic hashing
- binary Merkle-derived integrity structures
- RS256 JSON Web Signature issuance
- independently verifiable receipt payloads
- public-key verification endpoints
- stateless verification workflows
- zero-retention processing architecture
The goal is not to create another software inventory dashboard.
The goal is to create portable cryptographic evidence artifacts that remain independently verifiable outside the original issuance environment.
Receipt Issuance Model
A submitted manifest undergoes:
- canonical normalization
- deterministic digest generation
- integrity derivation
- signed receipt issuance
- verification-ready packaging
The resulting receipt contains:
- receipt identifier
- issuance timestamp
- integrity digests
- signing metadata
- verification scope
- embedded component summaries
- optional risk intelligence summaries depending on entitlement tier
The signed receipt can later be validated against the public verification key without requiring trust in mutable database state or exported screenshots.
Independent Verification
The verification layer is intentionally separated from issuance.
The platform exposes:
- public verification key infrastructure
- RS256 validation support
- signature integrity checking
- issuer linkage validation
- optional time-aware re-evaluation paths for advanced receipts
This creates an evidence model where:
- the signed artifact survives independently
- verification does not require the original submission session
- receipt authenticity can be checked later without exposing private signing material
That distinction is important.
Unsigned output is informational.
Signed output becomes cryptographically verifiable evidence.
Zero-Retention Processing
The platform operates under a zero-retention processing model.
Submitted manifests are not retained following computation. The architecture intentionally minimizes:
- evidentiary custody
- long-term manifest exposure
- centralized artifact retention risk
The system retains:
- receipt identifiers
- issuance metadata
- entitlement records
but not the original manifest payload itself.
Why This Matters
Modern compliance and supply chain workflows increasingly depend on:
- attestations
- evidence portability
- tamper detection
- provenance validation
- independently verifiable records
At the same time, software supply chain complexity and synthetic artifact generation continue increasing.
That creates pressure toward systems where:
- integrity can be mathematically validated
- evidence survives independently of the issuer
- verification is separable from custody
- authenticity is not dependent on screenshots or trust assumptions
CBOMCompliance.com was built around that architectural direction.
Not as a generalized compliance dashboard, but as cryptographic evidence infrastructure for software supply chain state verification.
Top comments (0)