In this section
Software bills of materials in Pillars
The problem this solves
A software bill of materials (SBOM) records components detected in a software artifact or project. It helps your team examine dependencies, review license metadata, and associate vulnerability findings with a build.
An SBOM is an inventory. It does not by itself establish that an artifact is free of vulnerabilities, meets a compliance requirement, or is approved for deployment.
How SBOM generation works in SmoothGlue
When the common syft job is selected, it scans the configured container image and
the checked-out project directory. It writes separate image and project SBOMs in these
formats:
- Syft text.
- SPDX JSON.
- CycloneDX XML.
- CycloneDX JSON.
The job retains the output as GitLab job artifacts and declares the image CycloneDX JSON file as a report. Availability of GitLab's report presentation depends on the installed edition and configuration; the artifact files remain the direct output.
This job does not attach the SBOM to an image in Nexus. Registry attachment or another delivery mechanism requires a separate configured workflow.
What the SBOM contains
The inventory depends on the image or project being scanned and the components Syft can detect. Review the produced document for package names, versions, relationships, and available license metadata.
Do not assume that every build-time dependency or complete build environment is represented in every format. Image and project inventories answer different questions. Keep the records associated with their producing pipeline and image reference.
What SmoothGlue handles for you
The common Syft job creates the files when its rules select it. A separate Grype job scans the image for vulnerabilities. That job scans the image reference directly rather than consuming the files produced by the Syft job.
The software-bill-of-material job packages collected SBOM directories into .zip
and .tar.gz archives. The body-of-evidence job packages collected evidence
directories. Their job rules determine whether they run automatically or manually.
For the applicable release workflow, attach-artifacts uploads the archives to the
GitLab release and requires RELEASE_TOKEN. These outputs are not guaranteed on
every passing pipeline.
What you still own
Confirm that the expected SBOM and analysis jobs ran and completed successfully. Retain the records according to your organization's requirements and verify that they correspond to the artifact you intend to deliver.
Review vulnerability findings and license metadata with the responsible teams. An inventory does not replace that review. New vulnerability information can appear after the build, so follow your organization's process for reassessment.