Skip to main content

Software bill of materials (SBOM)

Roasthubs publishes a machine-readable Software Bill of Materials for each product release (EU Cyber Resilience Act — Annex I Part II §1).

Current release

No release SBOM has been published into this docs site yet. The next roasthubs-os GitHub Release will update this page via the docs automation.

What is covered

LayerComponentsHow versioned
Applicationroasthubs-os container imageRelease tag (CycloneDX on the GitHub Release)
Edge containersPostgres, nginx, Prometheus, node-exporter, CloudWatch agentImage tags from the edge compose / sbom/edge-stack.yml
Host (declared)Operating system (Ubuntu on Welotec IPC), Docker EngineSite-specific — recorded at install / support review

Full dependency trees live in CycloneDX JSON files attached to the GitHub Release for that tag — not inlined on this page.

How to get the SBOM for a release

  1. Open the release on GitHub for the tag running on your edge server (see Deployments / support).
  2. Download the assets named like:
    • sbom-roasthubs-os-<tag>.cyclonedx.json — app image
    • sbom-edge-<service>-<tag>.cyclonedx.json — each companion image
    • sbom-edge-stack-<tag>.cyclonedx.json — edge inventory (host + containers)
    • sbom-summary-<tag>.md — human-readable index

Authorities or customers may request these files; retain release assets for the support period.

Vulnerability reporting

See Vulnerability disclosure.