27 lines
1020 B
Markdown
27 lines
1020 B
Markdown
docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json
|
|
|
|
nginx:1.27-alpine, CycloneDX json
|
|
|
|
{
|
|
"type": "application",
|
|
"author": "anchore",
|
|
"name": "syft",
|
|
"version": "1.50.0"
|
|
}
|
|
"bom-ref": "7cfd11f0aac064b9",
|
|
"type": "container",
|
|
"name": "nginx",
|
|
"version": "1.27-alpine"
|
|
"bom-ref": "pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=x86_64&distro=alpine-3.21.3&package-id=0df337d25a2602d5",
|
|
|
|
|
|
"type": "library",
|
|
"publisher": "Natanael Copa <ncopa@alpinelinux.org>",
|
|
"name": "alpine-baselayout",
|
|
"version": "3.6.8-r1",
|
|
"description": "Alpine base dir structure and init scripts",
|
|
|
|
|
|
it inventories components but does not determine whether the image is free of vulnerabilities or safe to deploy
|
|
|
|
bom helps after new CVE by revealing if the packege is install insude the image and also if the vulnerable version is running |