Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 6. Compliance verification by using image SBOMs

Auditing the software bill of materials (SBOM) enables security teams to identify components that might be subject to common vulnerabilities and exposures (CVEs).

To achieve security and compliance goals, use the SBOM to perform auditing tasks, such as:

  • Vulnerability scanning: Import the SBOM into auditing tools to cross-reference package versions against known security vulnerabilities.
  • License verification: Review the metadata section of the SBOM to ensure all open source licenses meet corporate legal standards.
  • Package integrity: Verify that the package hashes listed in the SBOM match the binaries present in the active container environment.

The software bill of materials (SBOM) lists all software components, libraries, and dependencies in Red Hat Hardened Images. Use the SBOM to verify software integrity, identify security vulnerabilities, and ensure compliance with security standards.

Note

For production audits, always verify against the immutable image digest rather than a mutable tag, such as :latest, to ensure you are auditing the deployed image.

Procedure

  • Use one of the following methods to display the SBOM for an image:

    • To display the SBOM in the Red Hat Hardened Images catalog:

      1. Open https://images.redhat.com in your browser.
      2. Click to the tile of the image.
      3. Open the SBOM tab.

    • To create the SBOM on a local host, use the cosign-rhel9 container: 

      $ podman run \
    registry.redhat.io/rhtas/cosign-rhel9:1.2.2 \
    cosign download sbom \
      registry.access.redhat.com/hi/curl > sbom.json

      The command redirects the output to the sbom.json file.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top