Skip to content

Modelcar SBOM

The Mobster tool is capable of generating SBOMs for modelcar based on the guidelines from the Red Hat Product Security.

After composing the modelcar / base / model relationships, Mobster scans the base image with Syft and merges that package inventory under the base image node (CONTAINS in SPDX, dependencies in CycloneDX). Scan the base, not the assembled ModelCar with weight layers.

Usage

mobster generate \
    --output modelcar.sbom.spdx.json \
    modelcar \
    --modelcar-image quay.io/example/modelcar:v22@sha256:cc6016b62f25d56507033c48b04517ba40b3490b1e9b01f1c485371311ed42c4 \
    --base-image quay.io/example/base:9.0@sha256:96fbb4c227d543011dfff0679a89ce664d1a009654858f2df28be504bc1863c1 \
    --model-image quay.io/example/model:v1@sha256:087dc7896b97911a582702b45ff1d41ffa3e142d0b000b0fbb11058188293cfc \
    --sbom-type spdx

The same flow works with --sbom-type cyclonedx.

List of arguments:

  • --modelcar-image
  • Modelcar image pullspec with digest (optional tag) repository/image:tag@sha256:hexvalue
  • Example value quay.io/example/modelcar:v22@sha256:cc6016b62f25d56507033c48b04517ba40b3490b1e9b01f1c485371311ed42c4
  • --base-image
  • Modelcar base image pullspec with digest (optional tag) repository/image:tag@sha256:hexvalue
  • Example value quay.io/example/base:9.0@sha256:96fbb4c227d543011dfff0679a89ce664d1a009654858f2df28be504bc1863c1
  • --model-image
  • Model image pullspec with digest (optional tag) repository/image:tag@sha256:hexvalue
  • Example value quay.io/example/model:v1@sha256:087dc7896b97911a582702b45ff1d41ffa3e142d0b000b0fbb11058188293cfc
  • --output
  • Path where the SBOM should be written
  • --sbom-type
  • Type of SBOM to generate (spdx or cyclonedx)

Example

The example composition SBOMs (before Syft inventory) are available in: - tests/data/modelcar_sbom.spdx.json. - tests/data/modelcar_sbom.cyclonedx.json.

Structure of the generated SBOM

The generated SBOM has following structure:

 - SPDXRef-DOCUMENT
    - SPDXRef-modelcar-image
        - Base image (DESCENDANT_OF)
            - Syft packages from base scan (CONTAINS)
        - Model image (DESCENDANT_OF)

The CycloneDX SBOM has the equivalent structure:

 - modelcar-image
    - base-image
        - Syft components from base scan
    - model-image

modelcar