Provenance

In the LiteLLM 1.107.0 compromise the bill of materials, the provenance attestation and the image signature were all accurate, and none of them described the files that ran. The payloads in this year's supply chain attacks lived in install hooks, Python startup files and agent instruction files.

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.