红帽全球峰会15.6. Generating SBOMs from scanned images
You can use RHACS to generate a Software Bill of Materials (SBOM) from scanned container images.
Generation of SBOMs from the scanned container images is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.
Scanner V4 must be enabled to generate SBOMs. For information about enabling Scanner V4, see the following resources:
For OpenShift Container Platform:
- Installing Central using the Operator method
- Scanner V4 (Helm installation)
For Kubernetes:
- Scanner V4 (Helm installation)
SBOMs give you a detailed overview of software components, dependencies, and libraries within your application. RHACS uses the results of scans performed by Scanner V4 to generate an SBOM. You can generate an SBOM by using the RHACS portal, the roxctl CLI, or the RHACS API.
Scanner V4 cannot generate SBOMs from results of delegated scans. In delegated scanning, you are using your secured cluster to index images and sending data to Central for vulnerability matching. SBOM generation is only available when using Scanner V4 configured in Central.
15.6.1. About SBOMs
A Software Bill of Materials (SBOM) is a digital record that lists the components of a piece of software and their origins. Organizations can use SBOMs to locate the presence of vulnerable software packages and components and respond more quickly to mitigate the risk. Additionally, being able to generate SBOMs assists organizations in complying with Executive Order 14028: Improving the Nations Cybersecurity.
SBOMs can contain different types of information, depending on the methods of data collection and how they are generated. The Cybersecurity & Infrastructure Security Agency (CISA) provides a document, Types of Software Bill of Materials (SBOM), that summarizes the types of SBOMs.
The type of SBOM that RHACS generates is "Analyzed." CISA notes that these types of SBOMs are created through an analysis of artifacts such as executables, packages, containers, and virtual machine images. Analyzed SBOMs provide the following benefits, as summarized by CISA:
- They can provide information about software without an active development environment.
- They can be generated without access to the build process.
- You can use them to discover hidden dependencies that might be missed by other tools.
The SBOM generated by RHACS is in System Package Data Exchange (SPDX) 2.3 format.
15.6.2. Generating SBOMs
You can generate SBOMs by using the following methods:
- Using the RHACS portal
Go to Vulnerability Management
Results and locate the image that you want to use. Do one of the following actions: -
In the image row, click the overflow menu
, and then select Generate SBOM.
- Select the image to view the image details, and then click Generate SBOM.
A window opens that provides information about the image and the SBOM format that is generated. After you click Generate SBOM, RHACS creates the file in JSON format. Depending on your browser configuration, your browser can automatically download the file to your computer.
-
In the image row, click the overflow menu
- Using the
roxctlCLI In the
roxctlCLI, run the following command:$ roxctl image sbom --image=image-name1 - 1
- Type the name and reference of the image that you want to generate an SBOM for, in string format. For example,
nginx:latestornginx@sha256:….
This command has the following options:
| Option | Description |
|---|---|
|
|
Bypass Central’s cache for the image and force a new pull from the scanner. The default is |
|
| Sets the time to wait between retries in seconds. The default is 3. |
|
|
Image name and reference, for example, |
|
| Sets the number of times that Scanner V4 should retry before exiting with an error. The default is 3. |
- Using the API
-
You can use the RHACS API to create an SBOM. You must use the
ROX_API_TOKENfor authorization to connect to the endpoint and generate the SBOM. The request payload is generated in JSON format.
See "GenerateSBOM" in the API reference for more information.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}