Quarry Releases

Tagged releases bind a git tag to changelog, artifacts, and SBOM. Scan chips come from real Trivy runs on the release SBOM (no invented CVE ids).