From b9abe15562055568df392fbc4d69b6ccff2f6713 Mon Sep 17 00:00:00 2001
From: Zanie Blue <contact@zanie.dev>
Date: Tue, 3 Mar 2026 12:14:06 -0600
Subject: [PATCH] Add SBOM attestations to Docker images (#18252)

Adds SBOM attestations
https://docs.docker.com/build/metadata/attestations/sbom/

Requires https://github.com/rust-secure-code/cargo-auditable/pull/236
for our uv binaries and their dependencies to be included in the SBOM

You can inspect the SBOM with, e.g.:

```
docker buildx imagetools inspect ghcr.io/astral-sh/uv-dev:sha-ece6427 --format '{{json .SBOM}}' | jq
docker buildx imagetools inspect ghcr.io/astral-sh/uv-dev:sha-ece6427-python3.9-trixie --format '{{json .SBOM}}' | jq
```

Also explicitly sets
https://docs.docker.com/build/metadata/attestations/slsa-provenance/#max
but there appears to be no change as all of the max SLSA data is already
present.
---
 .github/workflows/build-docker.yml |  4 ++++
 Dockerfile                         | 10 +++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 9d6206b59..77b9a4e3b 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -161,6 +161,8 @@ jobs:
           push: ${{ needs.docker-plan.outputs.push }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: mode=max
+          sbom: true
           # TODO(zanieb): Annotations are not supported by Depot yet and are ignored
           annotations: ${{ steps.meta.outputs.annotations }}
 
@@ -315,6 +317,8 @@ jobs:
           push: ${{ needs.docker-plan.outputs.push }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: mode=max
+          sbom: true
           # TODO(zanieb): Annotations are not supported by Depot yet and are ignored
           annotations: ${{ steps.meta.outputs.annotations }}
 
diff --git a/Dockerfile b/Dockerfile
index ba3085fe2..a35ee1aeb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,10 +39,18 @@ RUN rustup target add $(cat rust_target.txt)
 COPY crates crates
 COPY ./Cargo.toml Cargo.toml
 COPY ./Cargo.lock Cargo.lock
+
+# Install patched cargo-auditable with Zig linker support
+RUN cargo install \
+  --git https://github.com/rust-secure-code/cargo-auditable.git \
+  --rev caa964b714d8da6b1139b8e7a0a2ba5979235f22 \
+  --locked \
+  cargo-auditable
+
 RUN case "${TARGETPLATFORM}" in \
   "linux/arm64") export JEMALLOC_SYS_WITH_LG_PAGE=16;; \
   esac && \
-  cargo zigbuild --bin uv --bin uvx --target $(cat rust_target.txt) --release
+  cargo auditable zigbuild --bin uv --bin uvx --target $(cat rust_target.txt) --release
 RUN cp target/$(cat rust_target.txt)/release/uv /uv \
   && cp target/$(cat rust_target.txt)/release/uvx /uvx
 # TODO(konsti): Optimize binary size, with a version that also works when cross compiling