It depends on how they are stored. When an SBOM or signature is attached as a referrer to the image, some registries expire it with the image. Amazon ECR documents that reference artifacts expire within 24 hours of the subject image being deleted or archived. Check your registry, and keep your own copy.
Definitions
The OCI distribution specification defines a subject as an association from one manifest to another, typically used to attach an artifact to an image. A referrers list is the list of manifests that have a subject relationship to a given digest. Signatures, SBOMs and attestations are commonly stored this way, as their own manifests pointing at the image digest.
That design is neat for discovery, since you can ask the registry which artifacts refer to an image. It also means these artifacts live and die alongside registry cleanup rules.
What ECR says
ECR states that when reference artifacts are present in a repository, lifecycle policies automatically expire or archive those artifacts within 24 hours of the deletion or archival of the subject image. So a rule that expires an image takes its attached artifacts with it a day later. This is sensible, as an SBOM for a missing image is of little use in the registry, but it matters for evidence.
Other registries
Google Artifact Registry documents that cleanup policies for Docker images do not delete images referenced by a parent manifest, and that related images are deleted when the parent is deleted. That describes parent and child manifests, which is related but not the same as referrers. Read the documentation for how your registry handles attached artifacts, and test with a throwaway image: attach a test artifact, delete the subject, and see what remains.
I could not confirm from the sources checked here how every registry treats referrers on manual deletion, so verify rather than assume.
What to keep outside the registry
| Item | Why keep a copy | Where |
|---|---|---|
| Image digest | It identifies exactly what shipped | Release record |
| SBOM | Answers which components were in the release | Evidence store or SBOM platform |
| Scan result | Shows what was known at release time | Evidence store |
| Signature or attestation bundle | Proves who built it | Release record or evidence store |
The registry copy is for operations. The evidence copy is for audits, customer questions and incident response, and it needs its own retention period. See how long to keep container scan evidence for audits and attach an SBOM to a container image with cosign.
A simple test
- Push a test image and attach a test SBOM.
- List its referrers.
- Delete the image, or let a rule expire it.
- List referrers again, and look for the SBOM by its own digest.
Record the answer in your runbook. It is a ten minute test that settles the question for your registry.
Where Safeguard fits
Safeguard's SBOM and compliance evidence automation can keep SBOMs and scan records independent of registry cleanup. A free scan is at gold.safeguard.sh/scan.
Quick check
Will my SBOM survive if the image expires?
Not necessarily. In ECR, attached reference artifacts expire within 24 hours of the subject. Keep a separate copy.
Is a signature useful without the image?
Not for pulling, but the record of who signed what can still matter for audit, so keep the evidence.
Sources
Last reviewed: 19 October 2026.
