CKS-Lessons/lab/lesson-30-answer.md

docker run --rm ghcr.io/anchore/syft:v1.50.0 nginx:1.27-alpine -o cyclonedx-json > .\lab\lesson-30-sbom.json

nginx:1.27-alpine, CycloneDX json

    {
      "type": "application",
      "author": "anchore",
      "name": "syft",
      "version": "1.50.0"
    }
          "bom-ref": "7cfd11f0aac064b9",
  "type": "container",
  "name": "nginx",
  "version": "1.27-alpine"
        "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=x86_64&distro=alpine-3.21.3&package-id=0df337d25a2602d5",
 
 
  "type": "library",
  "publisher": "Natanael Copa <ncopa@alpinelinux.org>",
  "name": "alpine-baselayout",
  "version": "3.6.8-r1",
  "description": "Alpine base dir structure and init scripts",


  it inventories components but does not determine whether the image is free of vulnerabilities or safe to deploy

  bom helps after new CVE by revealing if the packege is install insude the image and also if the vulnerable version is running