Where does the 16MB attestation artifact size limit come from?

[saxonww]

We're running into a problem where we exceed the predicate size limit introduced in #80. We have a few container images with SBOMs exceeding that size limit.

What is the reason for a 16MB size limit? #80 does not link to or contain any discussion about this. It doesn't seem to be driven by library or specification requirements. A forked version of this action with #80 removed, plus a forked version of actions/attest-sbom using it, seems to allow creation and upload of an attestation with larger predicates.

Assuming our SBOMs are the size they need to be, what are our options for working around this?

[jkylekelly]

Hi @saxonww, we've defined the 16MB size limit based on a point-in-time evaluation of expected/ reasonable attestation sizes. We currently utilize the in-toto SBOM specification for the actions/attest-sbom action, which encapsulates the full SBOM.

As you've pointed out, the size limit is not enforced beyond this action, however, exceeding this size limit is unsupported and is prone to errors (e.g., timeouts). In addition, we may introduce size restrictions elsewhere in the future that would break the described workaround.

Out of curiosity, how large is the SBOM you're attesting?

[saxonww]

One I just generated was 17MB. I believe the one I was working with when filing this issue was 22MB.

I can't really speak to how much effort we've put into minimizing image size/complexity.