SCIM(Microsoft)

Supply Chain Integrity Model (SCIM)

https://gyazo.com/246747eead9ef9d5c1aea1cb26025ab2

A Supplier creates an Artifact (a). An Attester creates Evidence (b) and submits to a Store for logging, query, and retrieval. The Supplier and Attester may be the same entity. A Policy Manager creates Policy (c) and submits to a Store where it is recorded and made available for query and retrieval. A User Agent receives an Artifact, retrieves Evidence and Policy, and verifies the Artifact (d).

アーティファクトの他にエビデンスとポリシーも扱う

エビデンス

SBOMやファイル一覧はこれ

構成やら脆弱性無いですよやらを示す諸々

ポリシー

アーティファクトを評価するポリシー

ストアはエビデンスとポリシー用

が、古いようだ