Software bill of materials (SBOM)
Roasthubs publishes a machine-readable Software Bill of Materials for each product release (EU Cyber Resilience Act — Annex I Part II §1).
Current release
No release SBOM has been published into this docs site yet. The next roasthubs-os GitHub Release will update this page via the docs automation.
What is covered
| Layer | Components | How versioned |
|---|---|---|
| Application | roasthubs-os container image | Release tag (CycloneDX on the GitHub Release) |
| Edge containers | Postgres, nginx, Prometheus, node-exporter, CloudWatch agent | Image tags from the edge compose / sbom/edge-stack.yml |
| Host (declared) | Operating system (Ubuntu on Welotec IPC), Docker Engine | Site-specific — recorded at install / support review |
Full dependency trees live in CycloneDX JSON files attached to the GitHub Release for that tag — not inlined on this page.
How to get the SBOM for a release
- Open the release on GitHub for the tag running on your edge server (see Deployments / support).
- Download the assets named like:
sbom-roasthubs-os-<tag>.cyclonedx.json— app imagesbom-edge-<service>-<tag>.cyclonedx.json— each companion imagesbom-edge-stack-<tag>.cyclonedx.json— edge inventory (host + containers)sbom-summary-<tag>.md— human-readable index
Authorities or customers may request these files; retain release assets for the support period.