Software bill of materials (SBOM)
Roasthubs publishes a machine-readable Software Bill of Materials for each product release (EU Cyber Resilience Act — Annex I Part II §1).
Current release
v0.0.0.3 — CycloneDX files are mirrored on this docs site (see links below) and attached to the GitHub Release.
| Artifact | Link |
|---|---|
| App image (CycloneDX) | sbom-roasthubs-os-v0.0.0.3.cyclonedx.json |
| Edge stack inventory | sbom-edge-stack-v0.0.0.3.cyclonedx.json |
| Human-readable summary | sbom-summary-v0.0.0.3.md |
What is covered
| Layer | Components | How versioned |
|---|---|---|
| Application | roasthubs-os container image | Release tag (CycloneDX) |
| Edge containers | Postgres, nginx, Prometheus, node-exporter, CloudWatch agent | Image tags from the edge compose / sbom/edge-stack.yml |
| Host (declared) | Operating system (Ubuntu on Welotec IPC), Docker Engine | Site-specific — recorded at install / support review |
Edge containers (this release)
| Service | Image | SBOM file | OK |
|---|---|---|---|
| postgres | postgres:15 | sbom-edge-postgres-v0.0.0.3.cyclonedx.json | yes |
| nginx | nginx:latest | sbom-edge-nginx-v0.0.0.3.cyclonedx.json | yes |
| prometheus | prom/prometheus:v2.41.0 | sbom-edge-prometheus-v0.0.0.3.cyclonedx.json | yes |
| node-exporter | quay.io/prometheus/node-exporter:latest | sbom-edge-node-exporter-v0.0.0.3.cyclonedx.json | yes |
| cloudwatch-agent | amazon/cloudwatch-agent:latest | sbom-edge-cloudwatch-agent-v0.0.0.3.cyclonedx.json | yes |
Declared host components
| Component | Version | Notes |
|---|---|---|
| Host operating system | site-specific | Ubuntu Linux on Welotec industrial PC. Exact version varies by fleet; record from /etc/os-release at install / support review. |
| Docker Engine | site-specific | Docker CE installed on the host via Ansible (setup_server). |
Full dependency trees live in the CycloneDX JSON files — not inlined on this page.
How to get the SBOM for a release
- Prefer the docs site mirror for the version you run: open Shared → Software bill of materials and download the CycloneDX files linked above (also available at
/sbom/<tag>/on the published site). - Or download the same assets from the GitHub Release for that tag.
- Use the docs version dropdown to switch manuals / SBOM pages for older releases.
Authorities or customers may request these files; retain release assets for the support period.