Skip to content

Retrieving SBOMs for MSR Images#

Mirantis publishes the MSR 4 images in registry.mirantis.com, the official Mirantis public registry, which is based on MSR 4. A Software Bill of Materials (SBOM) is generated and attached automatically to each image of every release.

This section is intended for security, compliance, and platform engineers who need to know the contents of the MSR images that Mirantis ships, for example, to track vulnerabilities, verify license compliance, or meet regulatory requirements.

Supported SBOM Formats#

Mirantis publishes the SBOMs for the MSR images only in the SPDX 2.3 JSON format (application/spdx+json).

Note

The CycloneDX format that MSR supports since 4.13.8 applies only to the SBOMs that you generate in your own MSR instance. For details, refer to Managing SBOMs.

Retrieve an SBOM Using the Web UI#

Use the web UI for one-off inspection of an SBOM. This method enables you to download the raw SPDX JSON or view the package table in the UI. For automation, use API or ORAS method.

Procedure:

  1. Open the Mirantis registry web UI.
  2. Use the search bar to find the required image.

  3. Select the artifact to open its details page, then open the SBOM tab.

    The tab displays the packages in the image, along with their versions and license information.

  4. To save the raw SPDX JSON file, click Download SBOM.

Retrieve an SBOM Using the API#

The MSR API is the most reliable method for automation, as it reads the SBOM directly from the MSR accessory records. The API returns the raw SPDX JSON in the response body.

The SBOM endpoint takes the digest of the SBOM accessory, not the digest of the image:

GET /api/v2.0/projects/<project>/repositories/<repository>/artifacts/<sbom-digest>/additions/sbom

Procedure:

  1. Obtain the digest of the SBOM attached to the image. For example:

    SBOM_DIGEST=$(curl -s \
  "https://registry.mirantis.com/api/v2.0/projects/harbor/repositories/harbor-core/artifacts/v4.13.8?with_sbom_overview=true" \
  | jq -r '.sbom_overview.sbom_digest')

  2. Download the SPDX document:

    curl -s -o harbor-core-v4.13.8.spdx.json \
  "https://registry.mirantis.com/api/v2.0/projects/harbor/repositories/harbor-core/artifacts/${SBOM_DIGEST}/additions/sbom"

Retrieve an SBOM Using ORAS#

As the SBOM is stored as a standard OCI referrer artifact, generic OCI tooling such as ORAS can discover and pull it without using the MSR API. This method is more portable across registries than the API method and suits registry-agnostic pipelines.

Procedure:

  1. Install ORAS as described in the ORAS installation guide.

  2. Discover the referrers attached to the image. For example, to discover the SBOM accessory of the harbor-core image:

    oras discover registry.mirantis.com/harbor/harbor-core:v4.13.8 --artifact-type application/vnd.goharbor.harbor.sbom.v1

    Example of system response, where the SBOM manifest digest is marked:

    registry.mirantis.com/harbor/harbor-core@sha256:e0325557ec886422fb2ad33a9af7040afe8dbeae123884691c8243791eb343ea
└── application/vnd.goharbor.harbor.sbom.v1
    └── sha256:f35699ea90b9812a05a429c2a1e085ca32db4ce68d8e90c862269745bea3e63c  # <-- SBOM manifest digest
        └── [annotations]
            ├── created: "2026-10-05T17:05:35Z"
            ├── created-by: Harbor
            ├── org.opencontainers.artifact.created: "2026-10-05T17:05:35Z"
            └── org.opencontainers.artifact.description: SPDX JSON SBOM

  3. Pull the SBOM accessory using its manifest digest, for example:

    oras pull registry.mirantis.com/harbor/harbor-core@sha256:f35699ea90b9812a05a429c2a1e085ca32db4ce68d8e90c862269745bea3e63c

    Example of system response:

    ✓ Skipped     application/vnd.oci.image.layer.v1.tar                               327/327 KB 100.00%     0s
  └─ sha256:96e5d02163c5e48a535b51989bf3000b824a75c6a1f9f4306bf0d30fa5893979
✓ Skipped     application/vnd.goharbor.harbor.sbom.v1                              273/273  B 100.00%     0s
  └─ sha256:eab6b369b40e326dd1f2061db37e3bdae010ba8f452ebd267e923ce1074942c5
✓ Pulled      application/vnd.oci.image.manifest.v1+json                           768/768  B 100.00%   83µs
  └─ sha256:f35699ea90b9812a05a429c2a1e085ca32db4ce68d8e90c862269745bea3e63c

  4. Fetch the manifest of the SBOM accessory:

    oras manifest fetch registry.mirantis.com/harbor/harbor-core@sha256:f35699ea90b9812a05a429c2a1e085ca32db4ce68d8e90c862269745bea3e63c

  5. Fetch the SBOM blob:

    oras blob fetch registry.mirantis.com/harbor/harbor-core@sha256:96e5d02163c5e48a535b51989bf3000b824a75c6a1f9f4306bf0d30fa5893979 -o sbom.spdx.json

After you complete the procedure, the sbom.spdx.json file in your current directory contains the SBOM of the image in the SPDX JSON format.