Skip to content

SBOM Management#

A Software Bill of Materials (SBOM) is a structured inventory of the packages, libraries, and dependencies that make up a container image. MSR generates SBOMs using its configured vulnerability scanner, Trivy, and stores each SBOM as an OCI artifact accessory. An accessory is an OCI artifact that is linked to its parent artifact by digest and is stored separately from the artifact layers, alongside the vulnerability scan reports.

You can use SBOMs for:

  • Visibility into image contents: An SBOM lists the package names, versions, and licenses in an image, so you do not need to extract the image layers or re-scan the image to learn what it contains.
  • Faster response to new vulnerabilities: When a critical CVE is announced, you can search your SBOMs for the affected package and version instead of re-scanning every deployed image.
  • License compliance and auditability: The license information in SBOMs helps you verify compliance with licenses and other legal obligations.
  • Regulatory requirements: Regulations and standards such as the EU Cyber Resilience Act, NIS 2, and US Executive Order 14028 with the NTIA minimum elements require many organizations to provide SBOMs to their customers or auditors.

This section is intended for MSR administrators who generate and manage SBOMs for the artifacts in their MSR instance, and for security, compliance, and platform engineers who need the SBOMs that Mirantis publishes for the MSR images:

  • Managing SBOMs: Generate, view, download, delete, and replicate SBOMs for the artifacts that you store in your MSR instance.
  • Retrieving SBOMs for MSR Images: Download the SBOMs that Mirantis publishes for the MSR component images in registry.mirantis.com.