中文
devexamples
← Workflows

阅读中文版本

SBOM Generation and Review Workflow

Generate an SBOM per build in a standard format, store it with the artifact, review it for unapproved licenses and vulnerable components, and use it to answer supply chain questions fast.

intermediate~90 minsecuritysupply-chaincompliance

Objective

Produce and use a software bill of materials so component and vulnerability questions can be answered quickly.

Environment

  • An SBOM generator
  • A component and vulnerability database

Steps

1. Generate an SBOM for every build

Generate an SBOM for every build in a standard format.

Expected state: Each artifact has a component inventory.

2. Store the SBOM alongside the artifact

Store the SBOM alongside the artifact and version it.

Expected state: The inventory is reproducible per release.

3. Review for unapproved licenses and known-vulnerable

Review for unapproved licenses and known-vulnerable components.

Expected state: Risks are identified before release.

4. Use the SBOM to answer customer

Use the SBOM to answer customer and incident questions quickly.

Expected state: Supply chain queries are fast and accurate.

Decision points

Which SBOM format?

  • CycloneDX or SPDX
  • Custom format

Use a standard format; custom formats do not interoperate with consumer tooling.

Generate per build or per release?

  • Per build
  • Per release

Per build so any artifact can be queried; per release loses the mapping to intermediate builds.

Expected outcome

A per-build SBOM stored with the artifact, reviewed for license and vulnerability issues, and usable for fast supply chain queries.

Verification

Confirm a given release has an SBOM that lists the components actually in the image and that the review flagged known-vulnerable versions.

Cleanup

Retain SBOMs for the agreed retention period and link them from release records.

Overview

Produce and use a software bill of materials so component and vulnerability questions can be answered quickly. Confirm a given release has an SBOM that lists the components actually in the image and that the review flagged known-vulnerable versions.

Steps

  1. Generate an SBOM for every build in a standard format. Expected state: Each artifact has a component inventory.
  2. Store the SBOM alongside the artifact and version it. Expected state: The inventory is reproducible per release.
  3. Review for unapproved licenses and known-vulnerable components. Expected state: Risks are identified before release.
  4. Use the SBOM to answer customer and incident questions quickly. Expected state: Supply chain queries are fast and accurate.
syft $IMAGE -o cyclonedx-json > sbom.cdx.json
grype sbom:sbom.cdx.json --fail-on high

Verification

  • A per-build SBOM stored with the artifact, reviewed for license and vulnerability issues, and usable for fast supply chain queries.

Decision points

  • Which SBOM format? Options: CycloneDX or SPDX; Custom format. Recommended: Use a standard format; custom formats do not interoperate with consumer tooling.
  • Generate per build or per release? Options: Per build; Per release. Recommended: Per build so any artifact can be queried; per release loses the mapping to intermediate builds.