Petra: Verifiable Confidential SBOM Exchange

Overview

This series explains how Petra represents SBOMs as composable trees, protects claim values with attribute-based policies, and carries commitments, signatures, roots, and proofs across downstream exchange. These mechanisms support consistency and attribution, not completeness, accuracy, or production readiness.

Learning outcomes

Petra preserves SBOM relationships so upstream records can be composed into downstream artifacts without universal plaintext access.
Attribute-based policies expose claim values to authorized audiences while leaving the shared tree and its relationships available.
Commitments, Merkle roots, signatures, and membership proofs support consistency and attribution across redacted and redistributed views.
Petra cannot establish that an SBOM is complete or accurate, or that a policy leaves enough information for a task.

Keywords

PetraSBOMConfidentialityVerifiabilityCompositionSelective disclosureCP-ABEMerkle treeKMS

Chapters

Petra: Sharing SBOMs Without Full Exposure

Preserve relationships while limiting sensitive claims

9 min · Preserve relationships while limiting sensitive claims

9 min

Petra: The Composable SBOM Tree

How roles, paths, and identity preserve composition

9 min · How roles, paths, and identity preserve composition

9 min

Petra: Selective Disclosure for SBOM Claims

Attribute policies protect values without breaking relationships

9 min · Attribute policies protect values without breaking relationships

9 min

Petra: Verifying Redacted SBOMs

How roots and proofs bind redacted records

8 min · How roots and proofs bind redacted records

8 min

Petra Prototype: Evaluation and Limits

What the measurements do—and do not—establish

10 min · What the measurements do—and do not—establish

10 min

Petra: Verifiability Without Universal Visibility

Where cryptographic assurance meets governance

10 min · Where cryptographic assurance meets governance

10 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-6 Premium

FAQ

How does Petra keep an SBOM verifiable when some fields are hidden?

Petra preserves the tree’s relationships, binds redacted claims to pre-redaction commitments and a Merkle root, and carries signatures and proofs into authorized views and downstream copies. This supports consistency, not completeness or truth.

What does Petra let different SBOM recipients see?

Petra lets each recipient decrypt only claims authorized by their attribute-bound key, while the same redacted tree remains available to all. A vulnerability scanner might read versions, while a licensing consumer reads names and licenses.

Can Petra prove that an SBOM lists every dependency?

No. Petra can show that a redacted representation matches the structure the generator committed to, but it cannot recover a dependency the generator omitted or prove the source SBOM is complete.

What are Petra’s main deployment trade-offs?

Petra trades universal visibility for selective disclosure and verifiable composition, while accepting structural leakage, policy-driven cost, and reliance on KMS, verifiers, and source quality.