Skill Bundle Attestation (SBA) Specification - Initial Release

Skill Bundle Attestation v1.0.0 The first stable release of SBA — a deterministic bundle identity, content attestation format, and verification tooling for agent skill bundles. Highlights sba-directory-v1 — Canonical digest algorithm for deterministic bundle identification in-toto Statement v1 attestations with three predicate types: sba-content-v1 — Bundle content attestation sba-audit-v1 — Security audit attestation sba-approval-v1 — Deployment approval attestation DSSE envelope support — Ed25519, RSA-PSS/PKCS1v15, ECDSA signatures Sigstore integration — Keyless identity-based verification Security hardened — Path traversal protection, symlink rejection, case-collision detection Documentation 📄 RFC/Whitepaper (PDF) — Complete 25-page specification 📋 Specification — Protocol and algorithm details 🛡️ Threat Model — Security analysis and mitigations Standards Alignment SLSA v1.0 — Supply chain Levels for Software Artifacts in-toto Statement v1 — Attestation format DSSE — Dead Simple Signing Envelope Sigstore — Keyless signing infrastructure Installation pip install -e . Quick Start # Compute bundle digest sba digest path/to/skill # Create signed attestation sba attest content path/to/skill --envelope --sign --private-key key.pem -o attestation.json # Verify attestation sba verify attestation.json --bundle path/to/skill --verify-signatures --public-key key.pub Full changelog: https://github.com/jlov7/skill-bundle-attestation/blob/main/CHANGELOG.md