> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/software-supply-chain-assurance/troubleshooting-and-resources/faq.md).

# SCS FAQs

### General questions <a href="#general-questions" id="general-questions"></a>

#### 1. In which Harness stages can I use SCS steps? <a href="#id-1-in-which-harness-stages-can-i-use-scs-steps" id="id-1-in-which-harness-stages-can-i-use-scs-steps"></a>

* You can use SCS steps in the Harness CI, CD, and Security stages.

#### 2. Can you use Harness SCS through GitHub Actions? <a href="#id-2-can-we-use-harness-scs-via-github-actions" id="id-2-can-we-use-harness-scs-via-github-actions"></a>

* Yes. [Harness GitHub Actions](https://github.com/harness/github-actions) integrate Harness SCS capabilities into GitHub workflows. You can use this GitHub Action for supply chain security tasks with specific sub-actions.

#### 3. After we sign or attest the artifacts, do the existing .sig or .att files get overridden? <a href="#id-3-after-we-sign-or-attest-the-artifacts-do-the-existing-sig-or-att-files-get-overridden" id="id-3-after-we-sign-or-attest-the-artifacts-do-the-existing-sig-or-att-files-get-overridden"></a>

* After you attest an artifact, the `.att` file is not overwritten; each new attestation is appended to the existing file.
* After you sign an artifact, the `.sig` file is not overwritten; each new signature is appended to the existing file, but only if Attach Signature to Artifact Registry is enabled.

#### 4. What is the difference between attestation and signing? <a href="#id-4-what-is-the-difference-between-attestation-and-signing" id="id-4-what-is-the-difference-between-attestation-and-signing"></a>

* Attestation provides cryptographic proof of an artifact’s origin based on how and where it was created. It captures metadata about the build environment and verifies the artifact’s integrity before it is signed. Attestation serves as a trusted statement regarding the artifact’s provenance and the conditions under which it was produced.
* Signing involves applying a cryptographic signature to the artifact to ensure that the artifact has not been altered or tampered with after it was created.

#### 5. What does Cosign do behind the scenes during the time of attestation and signing? <a href="#id-5-what-does-cosign-do-behind-the-scenes-during-the-time-of-attestation-and-signing" id="id-5-what-does-cosign-do-behind-the-scenes-during-the-time-of-attestation-and-signing"></a>

* Behind the scenes, Cosign computes a digest (fingerprint) of the artifact, creates a digital signature or attestation using a private key, and then stores that signature/attestation as an OCI artifact in the registry. It also records the event in Rekor transparency log, ensuring the artifact’s authenticity, integrity, and provenance can later be verified.

#### 6. How do the SLSA/SBOM verification steps identify the appropriate attestation file from the artifact registry? <a href="#id-6-how-does-the-slsasbom-verification-steps-identify-the-appropriate-attestation-file-from-the-art" id="id-6-how-does-the-slsasbom-verification-steps-identify-the-appropriate-attestation-file-from-the-art"></a>

* The SLSA/SBOM verification step uses the artifact’s digest as a key to automatically locate and pull the corresponding `.att` file from the artifact registry.

#### 7. Which Cosign key types do you support? <a href="#id-7-what-are-the-cosign-key-types-do-you-support" id="id-7-what-are-the-cosign-key-types-do-you-support"></a>

* Harness SCS supports Cosign key type `ecdsa-p256`.

#### 8. How do you enable Rekor logs in the Artifact Signing step? <a href="#id-8-how-to-enable-the-rekor-logs-in-the-artifact-signing-step" id="id-8-how-to-enable-the-rekor-logs-in-the-artifact-signing-step"></a>

* Rekor logs are disabled by default. To enable them, navigate to **Project Settings**, select **Default Settings**, then disable Airgap mode in Supply Chain Security.

### SMP <a href="#smp" id="smp"></a>

#### 1. Does Harness SCS support SMP? <a href="#id-1-does-harness-scs-support-smp" id="id-1-does-harness-scs-support-smp"></a>

* Yes. Harness SCS supports SMP. Go to [supported Harness SCS features](/software-supply-chain-assurance/new-to-scs/ssca-supported.md#scs-on-harness-self-managed-enterprise-edition-smp) to review the features supported on SMP.

#### 2. How do I verify that all required SCS microservices are running on SMP? <a href="#id-2-how-do-i-verify-that-all-required-scs-microservices-are-running-on-smp" id="id-2-how-do-i-verify-that-all-required-scs-microservices-are-running-on-smp"></a>

* Once you run this command, `kubectl get pods -n <your-namespace>`. You should see both the `ssca-manager` and `ssca-ui` pods running.

#### 3. Where are my uploaded SBOMs and artifact signing signatures stored? <a href="#id-3-where-are-my-uploaded-sboms-and-artifact-signing-signatures-stored" id="id-3-where-are-my-uploaded-sboms-and-artifact-signing-signatures-stored"></a>

* First, you need to setup the minio:
* Then exec into minio pod `kubectl exec -it <minio-pod-name> -n <namespace> -- /bin/sh`
* Then type `ls /data`, will show all the buckets created inside minio. `sbom-store` should be one of them. if not then create it with these command
* `mc --help` this is to validate if `mc client` is present in pod.
* If `mc client` is not present you can install it with `mc alias set myminio http://localhost:9000 MINIO_ACCESS_KEY MINIO_SECRET_KEY`
* Once mc is installed, create the bucket using the command `mb myminio/sbom-store`

#### 4. Do I need additional configuration when using Amazon S3 or another S3-compatible object store instead of MinIO? <a href="#id-4-do-i-need-additional-configuration-when-using-amazon-s3-or-another-s3-compatible-object-store-i" id="id-4-do-i-need-additional-configuration-when-using-amazon-s3-or-another-s3-compatible-object-store-i"></a>

Yes. By default, the SBOM attestation workflow uploads artifacts to MinIO. For SMP deployments that use Amazon S3 or another S3-compatible storage service instead of MinIO, you must configure S3 connectivity and credentials for both the **component-service** and **ssca-manager** services.

The following example shows how to configure both services when using Amazon S3 or another S3-compatible object store instead of MinIO:

```yaml

ssca:
  component-service:
    componentService:
      bucketName: "your-bucket-name"
    config:
      S3_ENDPOINT: "https://your-s3-endpoint.com"
      S3_REGION: "us-west-2"
    secrets:
      kubernetesSecrets:
        - secretName: "your-s3-secret"
          keys:
            S3_ACCESS_KEY_ID: "accessKey"
            S3_ACCESS_SECRET_KEY: "secretKey"

  ssca-manager:
    ssca:
      bucketName: "your-bucket-name"
    config:
      S3_ENDPOINT: "https://your-s3-endpoint.com"
      S3_REGION: "us-west-2"
    secrets:
      kubernetesSecrets:
        - secretName: "your-s3-secret"
          keys:
            S3_ACCESS_KEY_ID: "accessKey"
            S3_ACCESS_SECRET_KEY: "secretKey"

```

{% hint style="info" %}
If the **ssca-manager** service is not configured with valid S3 credentials, the SBOM attestation step may fail with `HTTP 500` errors when attempting to upload attestation artifacts.
{% endhint %}

#### 5. Installed SMP via Harness Helm charts, how do I add other modules? <a href="#id-5-installed-smp-via-harness-helm-charts-how-do-i-add-other-modules" id="id-5-installed-smp-via-harness-helm-charts-how-do-i-add-other-modules"></a>

* The Harness Helm chart installs only the core platform components. To add other modules (like SCS, STO, etc.), you need to edit the `override.yaml` file and enable them explicitly.