Skip to main content
SmoothGlue Logo
← Back to App Deployment
Licensed guide

Generate an SBOM for a release

Export the CycloneDX SBOM attached to any container image from the Console or CLI — and include it in your ATO package or share it with a customer on request.

This guide includes:

  • Locating the SBOM for a specific image version in the Console (Artifacts → Images)
  • Downloading the CycloneDX JSON SBOM via the Console UI
  • Fetching the SBOM via CLI: smoothglue sbom export <image>:<tag>
  • Verifying the SBOM digest matches the published image SHA-256
  • Attaching the SBOM to an ATO package (format requirements for DISA/DoD submissions)
  • Reviewing Grype vulnerability scan results cross-referenced against the SBOM
Get your license key

Already have a license? Sign in to your account.