Component inventory and SBOM

With the sbom check on, a scan records the full component inventory of the repository, which you can export as a CycloneDX or SPDX document.

Turn the check on first

Enable and rescanbash

cf settings checks sbom --add
cf scan --wait

Exporting

Both formatsbash

cf sbom
cf sbom --format spdx
cf sbom --format cyclonedx --output sbom.json
cf sbom --scan <scan-id>

Flag	Values	Default
`--format`	`cyclonedx`, `spdx`	`cyclonedx`
`--output`	a file path	write to stdout
`--scan`	a scan id	the newest scan that has components

Without --output the document is written to stdout, which is what you want in a pipeline. With it, the file is written and only the path comes back.

What is in it

The components the scan resolved from your manifests and lockfiles, with their ecosystem, name, and version. Those are the same components the dependency check looks up vulnerabilities against, so the export and the findings agree with each other by construction.

When the export is empty

sbom_unavailable means the scan recorded no components. Either the check was off when it ran, or the repository declares no dependencies in a manifest format Cefense reads. See the ecosystem list in Checks.

Exporting an SBOMEvery flag on `cf sbom`, and what to pipe it into.ChecksTurning the inventory check on, and what else a scan can run.Container imagesThe inventory inside an image you ship, rather than in your manifests.

Have a correction or need help?

Email the docs team