https://kubeops.net/docs/tags/sbom/ Recent content in sbom on KubeOpsDoku Hugo -- gohugo.io https://kubeops.net/docs/kosi/how-to-guides/kositoolssbom/ Mon, 01 Jan 0001 00:00:00 +0000 https://kubeops.net/docs/kosi/how-to-guides/kositoolssbom/ <h2 id="how-to-use-kosi-tools-sbom">How to use KOSI Tools SBOM</h2> <p>This guide shows you how to use the <code>kosi tools sbom</code> command to generate and display a Software Bill of Materials (SBOM) for KOSI packages. You can generate SBOMs for both locally available packages and packages hosted on a hub.</p> <div class="alert warning callout" role="alert"> <strong>⚠ Warning</strong> Currently <code>kosi tools sbom</code> can only be used by a privileged user (root) and in a non-airgap environment. </div> <h4 id="prerequisites">Prerequisites</h4> <p>Before you begin, make sure the following prerequisites are met:</p> <ol> <li> <p><strong>Supported Operating Systems</strong>: KOSI tools are tested and supported on the following operating systems:</p> <ul> <li>Ubuntu 24.04</li> <li>Red Hat Enterprise Linux (RHEL) 9.6</li> </ul> </li> <li> <p><strong>Syft Installation</strong>: To execute the <code>sbom</code> command, you must have <strong>Syft</strong> installed on your machine.</p> </li> <li> <p><strong>A privileged user (root) and a non-airgap environment</strong>.</p> </li> </ol> <hr> <h3 id="installing-syft">Installing Syft</h3> <p>You can easily install Syft on our supported systems using <code>wget</code> to download the specific package format for your OS.</p> <ul class="nav nav-tabs" id="tabs-1" role="tablist"> <li class="nav-item"> <button class="nav-link disabled" id="tabs-01-00-tab" data-bs-toggle="tab" data-bs-target="#tabs-01-00" role="tab" aria-controls="tabs-01-00" aria-selected="false"> <strong>Operating-System</strong>: </button> </li><li class="nav-item"> <button class="nav-link active" id="tabs-01-01-tab" data-bs-toggle="tab" data-bs-target="#tabs-01-01" role="tab" data-td-tp-persist="ubuntu 24.04" aria-controls="tabs-01-01" aria-selected="true"> Ubuntu 24.04 </button> </li><li class="nav-item"> <button class="nav-link" id="tabs-01-02-tab" data-bs-toggle="tab" data-bs-target="#tabs-01-02" role="tab" data-td-tp-persist="rhel 9.6" aria-controls="tabs-01-02" aria-selected="false"> RHEL 9.6 </button> </li> </ul> <div class="tab-content" id="tabs-1-content"> <div class="tab-body tab-pane fade" id="tabs-01-00" role="tabpanel" aria-labelled-by="tabs-01-00-tab" tabindex="1"> </div> <div class="tab-body tab-pane fade show active" id="tabs-01-01" role="tabpanel" aria-labelled-by="tabs-01-01-tab" tabindex="1"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Define the Syft version (check GitHub for the current release)</span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># https://github.com/anchore/syft/releases/</span> </span></span><span style="display:flex;"><span><span style="color:#000">SYFT_VERSION</span><span style="color:#ce5c00;font-weight:bold">=</span><span style="color:#4e9a06">&#34;1.46.0&#34;</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Download the .deb package with wget</span> </span></span><span style="display:flex;"><span>wget https://github.com/anchore/syft/releases/download/v<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>/syft_<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>_linux_amd64.deb </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Install the downloaded package</span> </span></span><span style="display:flex;"><span>sudo dpkg --install syft_<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>_linux_amd64.deb </span></span></code></pre></div> </div> <div class="tab-body tab-pane fade" id="tabs-01-02" role="tabpanel" aria-labelled-by="tabs-01-02-tab" tabindex="1"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Define the Syft version (check GitHub for the current release)</span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># https://github.com/anchore/syft/releases/</span> </span></span><span style="display:flex;"><span><span style="color:#000">SYFT_VERSION</span><span style="color:#ce5c00;font-weight:bold">=</span><span style="color:#4e9a06">&#34;1.46.0&#34;</span> </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Download the .rpm package with wget</span> </span></span><span style="display:flex;"><span>wget https://github.com/anchore/syft/releases/download/v<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>/syft_<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>_linux_amd64.rpm </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># Install the downloaded package</span> </span></span><span style="display:flex;"><span>sudo dnf install syft_<span style="color:#4e9a06">${</span><span style="color:#000">SYFT_VERSION</span><span style="color:#4e9a06">}</span>_linux_amd64.rpm </span></span></code></pre></div> </div> </div> <div class="alert note callout" role="alert"> <strong>Note</strong> <hr> <p>Alternatively, you can install Syft universally using their official installation script:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>wget -qO- https://get.anchore.io/syft <span style="color:#000;font-weight:bold">|</span> sudo sh -s -- -b /usr/local/bin </span></span></code></pre></div> </div> <hr> <h2 id="usage-options">Usage Options</h2> <p>The command syntax for generating an SBOM is as follows:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>kosi tools sbom <span style="color:#ce5c00;font-weight:bold">[</span>options<span style="color:#ce5c00;font-weight:bold">]</span> <span style="color:#ce5c00;font-weight:bold">[</span>&lt;package&gt;<span style="color:#ce5c00;font-weight:bold">]</span> </span></span></code></pre></div><h3 id="available-arguments-and-options">Available Arguments and Options</h3> <table> <thead> <tr> <th style="text-align:left">Option</th> <th style="text-align:left">Description</th> </tr> </thead> <tbody> <tr> <td style="text-align:left"><code>&lt;package&gt;</code></td> <td style="text-align:left">The name or path of the package.</td> </tr> <tr> <td style="text-align:left"><code>-p, --local-package &lt;p&gt;</code></td> <td style="text-align:left">Show SBOM from a local package file (e.g., a <code>.tgz</code> archive).</td> </tr> <tr> <td style="text-align:left"><code>--hub</code></td> <td style="text-align:left">Show SBOM directly from a package located in the KOSI hub.</td> </tr> <tr> <td style="text-align:left"><code>-?, -h, --help</code></td> <td style="text-align:left">Show help and usage information.</td> </tr> </tbody> </table> <h2 id="examples">Examples</h2> <ul class="nav nav-tabs" id="tabs-3" role="tablist"> <li class="nav-item"> <button class="nav-link disabled" id="tabs-03-00-tab" data-bs-toggle="tab" data-bs-target="#tabs-03-00" role="tab" aria-controls="tabs-03-00" aria-selected="false"> <strong>Generating an SBOM</strong> </button> </li><li class="nav-item"> <button class="nav-link active" id="tabs-03-01-tab" data-bs-toggle="tab" data-bs-target="#tabs-03-01" role="tab" data-td-tp-persist="for a local package" aria-controls="tabs-03-01" aria-selected="true"> for a Local Package </button> </li><li class="nav-item"> <button class="nav-link" id="tabs-03-02-tab" data-bs-toggle="tab" data-bs-target="#tabs-03-02" role="tab" data-td-tp-persist="for a hub package" aria-controls="tabs-03-02" aria-selected="false"> for a Hub Package </button> </li> </ul> <div class="tab-content" id="tabs-3-content"> <div class="tab-body tab-pane fade" id="tabs-03-00" role="tabpanel" aria-labelled-by="tabs-03-00-tab" tabindex="3"> </div> <div class="tab-body tab-pane fade show active" id="tabs-03-01" role="tabpanel" aria-labelled-by="tabs-03-01-tab" tabindex="3"> <p>To generate an SBOM for a package that has already been downloaded to your local file system, use the <code>-p</code> (or <code>--local-package</code>) flag followed by the file name:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>kosi tools sbom -p metricsserver.tgz </span></span></code></pre></div><h3 id="example-output">Example output</h3> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># kosi tools sbom -p metricsserver.tgz</span> </span></span><span style="display:flex;"><span>2026-07-06 10:16:41 Info: KOSI version: KOSI version: 2.15.0.4_Beta0_1785144578 </span></span><span style="display:flex;"><span>---------------------------------------------------------------------- </span></span><span style="display:flex;"><span>Generate SBOM <span style="color:#204a87;font-weight:bold">for</span> image registry.kubeops.net/kubeops/kubeops/metrics-server/metrics-server:v0.8.0@sha256:3d2ca9b2af6aa14c9b698fa14e3a8f017f012517ebd1a6d3a36f28a4c56ae938 </span></span><span style="display:flex;"><span>NAME VERSION TYPE </span></span><span style="display:flex;"><span>base-files 12.4+deb12u11 deb </span></span><span style="display:flex;"><span>cel.dev/expr v0.20.0 go-module </span></span><span style="display:flex;"><span>github.com/NYTimes/gziphandler v1.1.1 go-module </span></span><span style="display:flex;"><span>github.com/antlr4-go/antlr/v4 v4.13.0 go-module </span></span><span style="display:flex;"><span>github.com/beorn7/perks v1.0.1 go-module </span></span><span style="display:flex;"><span>github.com/blang/semver/v4 v4.0.0 go-module </span></span><span style="display:flex;"><span>github.com/cenkalti/backoff/v4 v4.3.0 go-module </span></span><span style="display:flex;"><span>github.com/cespare/xxhash/v2 v2.3.0 go-module </span></span><span style="display:flex;"><span>github.com/coreos/go-semver v0.3.1 go-module </span></span><span style="display:flex;"><span>github.com/coreos/go-systemd/v22 v22.5.0 go-module </span></span><span style="display:flex;"><span>github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module </span></span><span style="display:flex;"><span>github.com/emicklei/go-restful/v3 v3.11.0 go-module </span></span><span style="display:flex;"><span>github.com/felixge/httpsnoop v1.0.4 go-module </span></span><span style="display:flex;"><span>github.com/fsnotify/fsnotify v1.8.0 go-module </span></span><span style="display:flex;"><span>github.com/fxamacker/cbor/v2 v2.7.0 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/logr v1.4.2 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/stdr v1.2.2 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/zapr v1.3.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonpointer v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonreference v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/swag v0.23.0 go-module </span></span><span style="display:flex;"><span>github.com/gogo/protobuf v1.3.2 go-module </span></span><span style="display:flex;"><span>github.com/golang/protobuf v1.5.4 go-module </span></span><span style="display:flex;"><span>github.com/google/btree v1.1.3 go-module </span></span><span style="display:flex;"><span>github.com/google/cel-go v0.23.2 go-module </span></span><span style="display:flex;"><span>github.com/google/gnostic-models v0.6.9 go-module </span></span><span style="display:flex;"><span>github.com/google/go-cmp v0.7.0 go-module </span></span><span style="display:flex;"><span>github.com/google/uuid v1.6.0 go-module </span></span><span style="display:flex;"><span>github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc go-module </span></span><span style="display:flex;"><span>github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 go-module </span></span><span style="display:flex;"><span>github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 go-module </span></span><span style="display:flex;"><span>github.com/josharian/intern v1.0.0 go-module </span></span><span style="display:flex;"><span>github.com/json-iterator/go v1.1.12 go-module </span></span><span style="display:flex;"><span>github.com/kylelemons/godebug v1.1.0 go-module </span></span><span style="display:flex;"><span>github.com/mailru/easyjson v0.7.7 go-module </span></span><span style="display:flex;"><span>github.com/moby/term v0.5.0 go-module </span></span><span style="display:flex;"><span>github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module </span></span><span style="display:flex;"><span>github.com/modern-go/reflect2 v1.0.2 go-module </span></span><span style="display:flex;"><span>github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module </span></span><span style="display:flex;"><span>github.com/pkg/errors v0.9.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_golang v1.22.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_model v0.6.2 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/common v0.65.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/procfs v0.15.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/prometheus v0.304.2 go-module </span></span><span style="display:flex;"><span>github.com/spf13/cobra v1.9.1 go-module </span></span><span style="display:flex;"><span>github.com/spf13/pflag v1.0.6 go-module </span></span><span style="display:flex;"><span>github.com/stoewer/go-strcase v1.3.0 go-module </span></span><span style="display:flex;"><span>github.com/x448/float16 v0.8.4 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/api/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/client/pkg/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/client/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/auto/sdk v1.1.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/metric v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/sdk v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/trace v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/proto/otlp v1.5.0 go-module </span></span><span style="display:flex;"><span>go.uber.org/multierr v1.11.0 go-module </span></span><span style="display:flex;"><span>go.uber.org/zap v1.27.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/crypto v0.38.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 go-module </span></span><span style="display:flex;"><span>golang.org/x/net v0.40.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/oauth2 v0.30.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sync v0.14.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sys v0.33.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/term v0.32.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/text v0.25.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/time v0.11.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb go-module </span></span><span style="display:flex;"><span>google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e go-module </span></span><span style="display:flex;"><span>google.golang.org/grpc v1.72.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/protobuf v1.36.6 go-module </span></span><span style="display:flex;"><span>gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module </span></span><span style="display:flex;"><span>gopkg.in/inf.v0 v0.9.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/natefinch/lumberjack.v2 v2.2.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/yaml.v3 v3.0.1 go-module </span></span><span style="display:flex;"><span>k8s.io/api v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/apimachinery v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/apiserver v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/client-go v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/component-base v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/klog/v2 v2.130.1 go-module </span></span><span style="display:flex;"><span>k8s.io/kms v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff go-module </span></span><span style="display:flex;"><span>k8s.io/metrics v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module </span></span><span style="display:flex;"><span>netbase 6.4 deb </span></span><span style="display:flex;"><span>sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/metrics-server UNKNOWN go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/randfill v1.0.0 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/structured-merge-diff/v4 v4.6.0 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/yaml v1.4.0 go-module </span></span><span style="display:flex;"><span>stdlib go1.24.4 go-module </span></span><span style="display:flex;"><span>tzdata 2025b-0+deb12u1 deb </span></span><span style="display:flex;"><span>---------------------------------------------------------------------- </span></span><span style="display:flex;"><span>Generate SBOM <span style="color:#204a87;font-weight:bold">for</span> image registry.kubeops.net/kubeops/kubeops/autoscaling/addon-resizer:1.8.23@sha256:4c24051f09c29ed6a855341754feb581b81e0f54aaedc7782edf2c9e7e67b3a7 </span></span><span style="display:flex;"><span>NAME VERSION TYPE </span></span><span style="display:flex;"><span>base-files 12.4+deb12u9 deb </span></span><span style="display:flex;"><span>github.com/beorn7/perks v1.0.1 go-module </span></span><span style="display:flex;"><span>github.com/blang/semver/v4 v4.0.0 go-module </span></span><span style="display:flex;"><span>github.com/cespare/xxhash/v2 v2.3.0 go-module </span></span><span style="display:flex;"><span>github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module </span></span><span style="display:flex;"><span>github.com/emicklei/go-restful/v3 v3.11.0 go-module </span></span><span style="display:flex;"><span>github.com/fxamacker/cbor/v2 v2.7.0 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/logr v1.4.2 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonpointer v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonreference v0.20.2 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/swag v0.23.0 go-module </span></span><span style="display:flex;"><span>github.com/gogo/protobuf v1.3.2 go-module </span></span><span style="display:flex;"><span>github.com/golang/protobuf v1.5.4 go-module </span></span><span style="display:flex;"><span>github.com/google/gnostic-models v0.6.8 go-module </span></span><span style="display:flex;"><span>github.com/google/go-cmp v0.6.0 go-module </span></span><span style="display:flex;"><span>github.com/google/gofuzz v1.2.0 go-module </span></span><span style="display:flex;"><span>github.com/google/uuid v1.6.0 go-module </span></span><span style="display:flex;"><span>github.com/josharian/intern v1.0.0 go-module </span></span><span style="display:flex;"><span>github.com/json-iterator/go v1.1.12 go-module </span></span><span style="display:flex;"><span>github.com/klauspost/compress v1.17.9 go-module </span></span><span style="display:flex;"><span>github.com/mailru/easyjson v0.7.7 go-module </span></span><span style="display:flex;"><span>github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module </span></span><span style="display:flex;"><span>github.com/modern-go/reflect2 v1.0.2 go-module </span></span><span style="display:flex;"><span>github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module </span></span><span style="display:flex;"><span>github.com/pkg/errors v0.9.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_golang v1.20.5 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_model v0.6.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/common v0.62.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/procfs v0.15.1 go-module </span></span><span style="display:flex;"><span>github.com/spf13/pflag v1.0.5 go-module </span></span><span style="display:flex;"><span>github.com/x448/float16 v0.8.4 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel v1.28.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/trace v1.28.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/net v0.33.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/oauth2 v0.24.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sys v0.28.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/term v0.27.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/text v0.21.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/time v0.7.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/protobuf v1.36.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module </span></span><span style="display:flex;"><span>gopkg.in/inf.v0 v0.9.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/yaml.v3 v3.0.1 go-module </span></span><span style="display:flex;"><span>k8s.io/api v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/apimachinery v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/autoscaler/addon-resizer v1.8.23 go-module </span></span><span style="display:flex;"><span>k8s.io/client-go v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/component-base v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/klog/v2 v2.130.1 go-module </span></span><span style="display:flex;"><span>k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f go-module </span></span><span style="display:flex;"><span>k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module </span></span><span style="display:flex;"><span>netbase 6.4 deb </span></span><span style="display:flex;"><span>sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/structured-merge-diff/v4 v4.4.2 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/yaml v1.4.0 go-module </span></span><span style="display:flex;"><span>stdlib go1.23.4 go-module </span></span><span style="display:flex;"><span>tzdata 2024b-0+deb12u1 deb </span></span></code></pre></div> </div> <div class="tab-body tab-pane fade" id="tabs-03-02" role="tabpanel" aria-labelled-by="tabs-03-02-tab" tabindex="3"> <p>To generate an SBOM for a package that is hosted on the KOSI hub without downloading it manually, specify the package name and use the <code>--hub</code> flag to specify the hub name:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>kosi tools sbom kubeops/metrics-server:2.2.0_Beta0 --hub kubeops </span></span></code></pre></div><h3 id="example-output">Example output</h3> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#8f5902;font-style:italic"># kosi tools sbom kubeops/metrics-server:2.2.0_Beta0 --hub kubeops</span> </span></span><span style="display:flex;"><span>2026-07-06 10:15:32 Info: KOSI version: 2.15.0.4_Beta0_1785144578 </span></span><span style="display:flex;"><span>2026-07-06 10:15:33 Info: ...Download 100% </span></span><span style="display:flex;"><span>2026-07-06 10:16:25 Info: Checking package <span style="color:#204a87">hash</span> </span></span><span style="display:flex;"><span>2026-07-06 10:16:25 Info: Hash checked succesfully. Is equal </span></span><span style="display:flex;"><span>---------------------------------------------------------------------- </span></span><span style="display:flex;"><span>Generate SBOM <span style="color:#204a87;font-weight:bold">for</span> image registry.kubeops.net/kubeops/kubeops/metrics-server/metrics-server:v0.8.0@sha256:3d2ca9b2af6aa14c9b698fa14e3a8f017f012517ebd1a6d3a36f28a4c56ae938 </span></span><span style="display:flex;"><span>NAME VERSION TYPE </span></span><span style="display:flex;"><span>base-files 12.4+deb12u11 deb </span></span><span style="display:flex;"><span>cel.dev/expr v0.20.0 go-module </span></span><span style="display:flex;"><span>github.com/NYTimes/gziphandler v1.1.1 go-module </span></span><span style="display:flex;"><span>github.com/antlr4-go/antlr/v4 v4.13.0 go-module </span></span><span style="display:flex;"><span>github.com/beorn7/perks v1.0.1 go-module </span></span><span style="display:flex;"><span>github.com/blang/semver/v4 v4.0.0 go-module </span></span><span style="display:flex;"><span>github.com/cenkalti/backoff/v4 v4.3.0 go-module </span></span><span style="display:flex;"><span>github.com/cespare/xxhash/v2 v2.3.0 go-module </span></span><span style="display:flex;"><span>github.com/coreos/go-semver v0.3.1 go-module </span></span><span style="display:flex;"><span>github.com/coreos/go-systemd/v22 v22.5.0 go-module </span></span><span style="display:flex;"><span>github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module </span></span><span style="display:flex;"><span>github.com/emicklei/go-restful/v3 v3.11.0 go-module </span></span><span style="display:flex;"><span>github.com/felixge/httpsnoop v1.0.4 go-module </span></span><span style="display:flex;"><span>github.com/fsnotify/fsnotify v1.8.0 go-module </span></span><span style="display:flex;"><span>github.com/fxamacker/cbor/v2 v2.7.0 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/logr v1.4.2 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/stdr v1.2.2 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/zapr v1.3.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonpointer v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonreference v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/swag v0.23.0 go-module </span></span><span style="display:flex;"><span>github.com/gogo/protobuf v1.3.2 go-module </span></span><span style="display:flex;"><span>github.com/golang/protobuf v1.5.4 go-module </span></span><span style="display:flex;"><span>github.com/google/btree v1.1.3 go-module </span></span><span style="display:flex;"><span>github.com/google/cel-go v0.23.2 go-module </span></span><span style="display:flex;"><span>github.com/google/gnostic-models v0.6.9 go-module </span></span><span style="display:flex;"><span>github.com/google/go-cmp v0.7.0 go-module </span></span><span style="display:flex;"><span>github.com/google/uuid v1.6.0 go-module </span></span><span style="display:flex;"><span>github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc go-module </span></span><span style="display:flex;"><span>github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 go-module </span></span><span style="display:flex;"><span>github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 go-module </span></span><span style="display:flex;"><span>github.com/josharian/intern v1.0.0 go-module </span></span><span style="display:flex;"><span>github.com/json-iterator/go v1.1.12 go-module </span></span><span style="display:flex;"><span>github.com/kylelemons/godebug v1.1.0 go-module </span></span><span style="display:flex;"><span>github.com/mailru/easyjson v0.7.7 go-module </span></span><span style="display:flex;"><span>github.com/moby/term v0.5.0 go-module </span></span><span style="display:flex;"><span>github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module </span></span><span style="display:flex;"><span>github.com/modern-go/reflect2 v1.0.2 go-module </span></span><span style="display:flex;"><span>github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module </span></span><span style="display:flex;"><span>github.com/pkg/errors v0.9.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_golang v1.22.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_model v0.6.2 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/common v0.65.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/procfs v0.15.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/prometheus v0.304.2 go-module </span></span><span style="display:flex;"><span>github.com/spf13/cobra v1.9.1 go-module </span></span><span style="display:flex;"><span>github.com/spf13/pflag v1.0.6 go-module </span></span><span style="display:flex;"><span>github.com/stoewer/go-strcase v1.3.0 go-module </span></span><span style="display:flex;"><span>github.com/x448/float16 v0.8.4 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/api/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/client/pkg/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.etcd.io/etcd/client/v3 v3.5.21 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/auto/sdk v1.1.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/metric v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/sdk v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/trace v1.35.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/proto/otlp v1.5.0 go-module </span></span><span style="display:flex;"><span>go.uber.org/multierr v1.11.0 go-module </span></span><span style="display:flex;"><span>go.uber.org/zap v1.27.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/crypto v0.38.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 go-module </span></span><span style="display:flex;"><span>golang.org/x/net v0.40.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/oauth2 v0.30.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sync v0.14.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sys v0.33.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/term v0.32.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/text v0.25.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/time v0.11.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb go-module </span></span><span style="display:flex;"><span>google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e go-module </span></span><span style="display:flex;"><span>google.golang.org/grpc v1.72.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/protobuf v1.36.6 go-module </span></span><span style="display:flex;"><span>gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module </span></span><span style="display:flex;"><span>gopkg.in/inf.v0 v0.9.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/natefinch/lumberjack.v2 v2.2.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/yaml.v3 v3.0.1 go-module </span></span><span style="display:flex;"><span>k8s.io/api v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/apimachinery v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/apiserver v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/client-go v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/component-base v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/klog/v2 v2.130.1 go-module </span></span><span style="display:flex;"><span>k8s.io/kms v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff go-module </span></span><span style="display:flex;"><span>k8s.io/metrics v0.33.2 go-module </span></span><span style="display:flex;"><span>k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module </span></span><span style="display:flex;"><span>netbase 6.4 deb </span></span><span style="display:flex;"><span>sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/metrics-server UNKNOWN go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/randfill v1.0.0 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/structured-merge-diff/v4 v4.6.0 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/yaml v1.4.0 go-module </span></span><span style="display:flex;"><span>stdlib go1.24.4 go-module </span></span><span style="display:flex;"><span>tzdata 2025b-0+deb12u1 deb </span></span><span style="display:flex;"><span>---------------------------------------------------------------------- </span></span><span style="display:flex;"><span>Generate SBOM <span style="color:#204a87;font-weight:bold">for</span> image registry.kubeops.net/kubeops/kubeops/autoscaling/addon-resizer:1.8.23@sha256:4c24051f09c29ed6a855341754feb581b81e0f54aaedc7782edf2c9e7e67b3a7 </span></span><span style="display:flex;"><span>NAME VERSION TYPE </span></span><span style="display:flex;"><span>base-files 12.4+deb12u9 deb </span></span><span style="display:flex;"><span>github.com/beorn7/perks v1.0.1 go-module </span></span><span style="display:flex;"><span>github.com/blang/semver/v4 v4.0.0 go-module </span></span><span style="display:flex;"><span>github.com/cespare/xxhash/v2 v2.3.0 go-module </span></span><span style="display:flex;"><span>github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go-module </span></span><span style="display:flex;"><span>github.com/emicklei/go-restful/v3 v3.11.0 go-module </span></span><span style="display:flex;"><span>github.com/fxamacker/cbor/v2 v2.7.0 go-module </span></span><span style="display:flex;"><span>github.com/go-logr/logr v1.4.2 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonpointer v0.21.0 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/jsonreference v0.20.2 go-module </span></span><span style="display:flex;"><span>github.com/go-openapi/swag v0.23.0 go-module </span></span><span style="display:flex;"><span>github.com/gogo/protobuf v1.3.2 go-module </span></span><span style="display:flex;"><span>github.com/golang/protobuf v1.5.4 go-module </span></span><span style="display:flex;"><span>github.com/google/gnostic-models v0.6.8 go-module </span></span><span style="display:flex;"><span>github.com/google/go-cmp v0.6.0 go-module </span></span><span style="display:flex;"><span>github.com/google/gofuzz v1.2.0 go-module </span></span><span style="display:flex;"><span>github.com/google/uuid v1.6.0 go-module </span></span><span style="display:flex;"><span>github.com/josharian/intern v1.0.0 go-module </span></span><span style="display:flex;"><span>github.com/json-iterator/go v1.1.12 go-module </span></span><span style="display:flex;"><span>github.com/klauspost/compress v1.17.9 go-module </span></span><span style="display:flex;"><span>github.com/mailru/easyjson v0.7.7 go-module </span></span><span style="display:flex;"><span>github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd go-module </span></span><span style="display:flex;"><span>github.com/modern-go/reflect2 v1.0.2 go-module </span></span><span style="display:flex;"><span>github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 go-module </span></span><span style="display:flex;"><span>github.com/pkg/errors v0.9.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_golang v1.20.5 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/client_model v0.6.1 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/common v0.62.0 go-module </span></span><span style="display:flex;"><span>github.com/prometheus/procfs v0.15.1 go-module </span></span><span style="display:flex;"><span>github.com/spf13/pflag v1.0.5 go-module </span></span><span style="display:flex;"><span>github.com/x448/float16 v0.8.4 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel v1.28.0 go-module </span></span><span style="display:flex;"><span>go.opentelemetry.io/otel/trace v1.28.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/net v0.33.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/oauth2 v0.24.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/sys v0.28.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/term v0.27.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/text v0.21.0 go-module </span></span><span style="display:flex;"><span>golang.org/x/time v0.7.0 go-module </span></span><span style="display:flex;"><span>google.golang.org/protobuf v1.36.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/evanphx/json-patch.v4 v4.12.0 go-module </span></span><span style="display:flex;"><span>gopkg.in/inf.v0 v0.9.1 go-module </span></span><span style="display:flex;"><span>gopkg.in/yaml.v3 v3.0.1 go-module </span></span><span style="display:flex;"><span>k8s.io/api v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/apimachinery v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/autoscaler/addon-resizer v1.8.23 go-module </span></span><span style="display:flex;"><span>k8s.io/client-go v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/component-base v0.32.1 go-module </span></span><span style="display:flex;"><span>k8s.io/klog/v2 v2.130.1 go-module </span></span><span style="display:flex;"><span>k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f go-module </span></span><span style="display:flex;"><span>k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 go-module </span></span><span style="display:flex;"><span>netbase 6.4 deb </span></span><span style="display:flex;"><span>sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/structured-merge-diff/v4 v4.4.2 go-module </span></span><span style="display:flex;"><span>sigs.k8s.io/yaml v1.4.0 go-module </span></span><span style="display:flex;"><span>stdlib go1.23.4 go-module </span></span><span style="display:flex;"><span>tzdata 2024b-0+deb12u1 deb </span></span></code></pre></div> </div> </div> https://kubeops.net/docs/kosi/reference/software-bill-of-materials/ Mon, 01 Jan 0001 00:00:00 +0000 https://kubeops.net/docs/kosi/reference/software-bill-of-materials/ <p>KubeOps publishes a <strong>Software Software Bill of Materials (SBOM)</strong> for the <code>kosi</code> command-line tooling that ships in the package repositories. It lists every bundled component with its exact version and license, in <a href="https://cyclonedx.org/">CycloneDX</a> format. The published document is the authoritative source — link to it rather than copying its contents, so the list never drifts out of date.</p> <h2 id="download">Download</h2> <p>The SBOM is served at a fixed path in each package repository. Both repositories ship the <strong>same</strong> SBOM document, so the only difference is the retrieval URL for your platform.</p> <ul class="nav nav-tabs" id="tabs-0" role="tablist"> <li class="nav-item"> <button class="nav-link disabled" id="tabs-00-00-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-00" role="tab" aria-controls="tabs-00-00" aria-selected="false"> <strong>KOSI</strong>: </button> </li><li class="nav-item"> <button class="nav-link active" id="tabs-00-01-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-01" role="tab" data-td-tp-persist="rhel / rpm" aria-controls="tabs-00-01" aria-selected="true"> RHEL / RPM </button> </li><li class="nav-item"> <button class="nav-link" id="tabs-00-02-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-02" role="tab" data-td-tp-persist="ubuntu / deb" aria-controls="tabs-00-02" aria-selected="false"> Ubuntu / DEB </button> </li> </ul> <div class="tab-content" id="tabs-0-content"> <div class="tab-body tab-pane fade" id="tabs-00-00" role="tabpanel" aria-labelled-by="tabs-00-00-tab" tabindex="0"> </div> <div class="tab-body tab-pane fade show active" id="tabs-00-01" role="tabpanel" aria-labelled-by="tabs-00-01-tab" tabindex="0"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -fsSLO https://packagerepo.kubeops.net/rpm/sbom/kosi-2.15.0.4_Beta0-0.x86_64.xml </span></span></code></pre></div><p>You can checkout all SBOMs here <a href="https://packagerepo.kubeops.net/rpm/sbom">sbom</a></p> </div> <div class="tab-body tab-pane fade" id="tabs-00-02" role="tabpanel" aria-labelled-by="tabs-00-02-tab" tabindex="0"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -fsSLO https://packagerepo.kubeops.net/deb/pool/main/sbom/kosi-2.15.0.4_Beta0-0.x86_64.xml </span></span></code></pre></div><p>You can checkout all SBOMs here <a href="https://packagerepo.kubeops.net/deb/pool/main/sbom">sbom</a></p> </div> </div> <h2 id="using-the-sbom">Using the SBOM</h2> <p>The CycloneDX document can be fed directly into SBOM-aware vulnerability scanners and license-compliance tooling without re-resolving dependencies, for example:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>grype sbom:./kosi-bom.xml <span style="color:#8f5902;font-style:italic"># vulnerability scan</span> </span></span><span style="display:flex;"><span>trivy sbom ./kosi-bom.xml <span style="color:#8f5902;font-style:italic"># vulnerability scan</span> </span></span></code></pre></div><blockquote class="note"><p>Scanner output reflects advisories at the time you run the scan, not at the time the SBOM was generated. Re-run scans regularly rather than relying on a single point-in-time result.</p> </blockquote> https://kubeops.net/docs/kubeopsctl-2.0/reference/software-bill-of-materials/ Mon, 01 Jan 0001 00:00:00 +0000 https://kubeops.net/docs/kubeopsctl-2.0/reference/software-bill-of-materials/ <p>KubeOps publishes a <strong>Software Software Bill of Materials (SBOM)</strong> for the <code>kubeopsctl</code> command-line tooling that ships in the package repositories. It lists every bundled component with its exact version and license, in <a href="https://cyclonedx.org/">CycloneDX</a> format. The published document is the authoritative source — link to it rather than copying its contents, so the list never drifts out of date.</p> <h2 id="download">Download</h2> <p>The SBOM is served at a fixed path in each package repository. Both repositories ship the <strong>same</strong> SBOM document, so the only difference is the retrieval URL for your platform.</p> <ul class="nav nav-tabs" id="tabs-0" role="tablist"> <li class="nav-item"> <button class="nav-link disabled" id="tabs-00-00-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-00" role="tab" aria-controls="tabs-00-00" aria-selected="false"> <strong>KUBEOPSCTL</strong>: </button> </li><li class="nav-item"> <button class="nav-link active" id="tabs-00-01-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-01" role="tab" data-td-tp-persist="rhel / rpm" aria-controls="tabs-00-01" aria-selected="true"> RHEL / RPM </button> </li><li class="nav-item"> <button class="nav-link" id="tabs-00-02-tab" data-bs-toggle="tab" data-bs-target="#tabs-00-02" role="tab" data-td-tp-persist="ubuntu / deb" aria-controls="tabs-00-02" aria-selected="false"> Ubuntu / DEB </button> </li> </ul> <div class="tab-content" id="tabs-0-content"> <div class="tab-body tab-pane fade" id="tabs-00-00" role="tabpanel" aria-labelled-by="tabs-00-00-tab" tabindex="0"> </div> <div class="tab-body tab-pane fade show active" id="tabs-00-01" role="tabpanel" aria-labelled-by="tabs-00-01-tab" tabindex="0"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -fsSLO https://packagerepo.kubeops.net/rpm/sbom/kubeopsctl-2.2.0.0_Beta0-0.x86_64.xml </span></span></code></pre></div><p>You can checkout all SBOMs here <a href="https://packagerepo.kubeops.net/rpm/sbom">sbom</a></p> </div> <div class="tab-body tab-pane fade" id="tabs-00-02" role="tabpanel" aria-labelled-by="tabs-00-02-tab" tabindex="0"> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -fsSLO https://packagerepo.kubeops.net/deb/pool/main/sbom/kubeopsctl-2.2.0.0_Beta0-0.x86_64.xml </span></span></code></pre></div><p>You can checkout all SBOMs here <a href="https://packagerepo.kubeops.net/deb/pool/main/sbom">sbom</a></p> </div> </div> <h2 id="using-the-sbom">Using the SBOM</h2> <p>The CycloneDX document can be fed directly into SBOM-aware vulnerability scanners and license-compliance tooling without re-resolving dependencies, for example:</p> <div class="highlight"><pre tabindex="0" style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>grype sbom:./kubeopsctl-bom.xml <span style="color:#8f5902;font-style:italic"># vulnerability scan</span> </span></span><span style="display:flex;"><span>trivy sbom ./kubeopsctl-bom.xml <span style="color:#8f5902;font-style:italic"># vulnerability scan</span> </span></span></code></pre></div><blockquote class="note"><p>Scanner output reflects advisories at the time you run the scan, not at the time the SBOM was generated. Re-run scans regularly rather than relying on a single point-in-time result.</p> </blockquote>