Skip to main content

Get the SBOM for your release

The release page of every supported Putki release carries a CycloneDX software bill of materials (SBOM) for each artifact your edition receives: one per container image and one per plugins archive. For the 2026.03 and 2026.06 lines, that is their latest patch release. Each lists the packages and libraries inside that artifact, with their versions and package URLs, so your security, compliance and procurement teams can inventory what you run without scanning it themselves.

FileDescribes
sbom-<image>-<release>.cdx.jsonOne image, for example sbom-putki-web-2026.09.02.cdx.json for forge.putki.io/putki/putki-web:2026.09.02
sbom-plugins-<release>-<edition>.cdx.jsonThe plugins archive plugins-<release>-<edition>.zip
sbom-plugins-<release>.cdx.json2026.03 and 2026.06: the one plugins archive plugins-<release>.zip

The SBOMs are made with Trivy, the scanner behind our vulnerability scans and the VEX file, so all three name packages the same way. An SBOM lists what is in the artifact; it does not list vulnerabilities, because those change every day. For our assessment of those, use the VEX file.

Before you start​

  • A forge.putki.io account with access to your edition's downloads, and an access token with repository: Read (see Install Putki plugins).
  • curl and jq.

1. Download the SBOMs​

Set your edition (basic, professional or enterprise) and the release you run. From 2026.09, each edition has its own release repository, putki/putki-dist-<edition>. The 2026.03 and 2026.06 lines were released before the editions, on putki/putki-dist:

EDITION=professional
RELEASE=2026.09.02
REPO=putki-dist-${EDITION}        # 2026.03 and 2026.06: REPO=putki-dist
curl -sS -u "<forgejo-username>:<token>" \
  "https://forge.putki.io/api/v1/repos/putki/${REPO}/releases/tags/v${RELEASE}" \
  | jq -r '.assets[] | select(.name|startswith("sbom-")) | .browser_download_url' \
  | while read -r url; do curl -sS -L -O -u "<forgejo-username>:<token>" "$url"; done

You can also download them by hand from your edition's release page on forge.putki.io.

2. Check that an SBOM matches what you run​

An image SBOM names the image it describes and its digest. Compare it with the image you pulled:

jq -r '.metadata.component.name, (.metadata.component.properties[]?
  | select(.name=="aquasecurity:trivy:RepoDigest") | .value)' sbom-putki-web-2026.09.02.cdx.json
docker image inspect --format '{{index .RepoDigests 0}}' forge.putki.io/putki/putki-web:2026.09.02

The two digests are the same when you run the image the SBOM describes.

3. Use it​

  • Inventory and licences: load the files into your SBOM tool (Dependency-Track, for example), or list the components directly: jq -r '.components[] | [.name, .version, .purl] | @tsv' sbom-putki-web-2026.09.02.cdx.json.
  • Vulnerabilities: scan the SBOM instead of the image, with our assessments applied: trivy sbom --vex vex.json sbom-putki-web-2026.09.02.cdx.json, or grype sbom:sbom-putki-web-2026.09.02.cdx.json --vex vex.json. See Use the VEX file with your scanner for the VEX file.

If something is missing​

  • No SBOM for an image. Older releases shipped fewer images than today; there is an SBOM for every image the release has.
  • The digests differ. You pulled the tag at another time, or from another release. Pull the release named in the file, or download the SBOMs of the release you run.