# SBOM — Roasthubs release `v0.0.0.3`

CRA Annex I Part II §1 — machine-readable SBOMs are attached to this GitHub Release.

## Application image
- `sbom-roasthubs-os-v0.0.0.3.cyclonedx.json` — CycloneDX for the `roasthubs-os` product image

## Edge stack (IPC)

### Declared (host — not scanned in CI)
- **Host operating system** — `site-specific` (operating-system)
- **Docker Engine** — `site-specific` (container-runtime)

### Containers (scanned when present)

| Service | Image | SBOM file | OK |
| --- | --- | --- | --- |
| postgres | `postgres:15` | `sbom-edge-postgres-v0.0.0.3.cyclonedx.json` | yes |
| nginx | `nginx:latest` | `sbom-edge-nginx-v0.0.0.3.cyclonedx.json` | yes |
| prometheus | `prom/prometheus:v2.41.0` | `sbom-edge-prometheus-v0.0.0.3.cyclonedx.json` | yes |
| node-exporter | `quay.io/prometheus/node-exporter:latest` | `sbom-edge-node-exporter-v0.0.0.3.cyclonedx.json` | yes |
| cloudwatch-agent | `amazon/cloudwatch-agent:latest` | `sbom-edge-cloudwatch-agent-v0.0.0.3.cyclonedx.json` | yes |

- Inventory: `sbom-edge-stack-v0.0.0.3.cyclonedx.json`
- Manifest: `edge-stack-manifest-v0.0.0.3.json`