SBOM

Tarook provides a Build Software Bill of Materials (Build SBOM), using the CycloneDX format. This means the SBOM has been generated during the build process of a new release.

Captured dependencies

There are currently three main dependency categories captured:

Nix dependencies

These are tracked by the bombon tool.

The scope of the Nix packages are collected from the dev and ci Nix environment.

Container Images

The dependencies of images used in the CI. The dependencies of these images are captured via syft.

Runtime dependencies

This includes Ansible galaxy collections and Helm Charts. These are collected by a Python script.

Depth of the SBOM

As for now we are collecting only direct dependencies for the Nix and runtime stages.

In the container stage we collect all dependencies, including transitive dependencies. This is caused by the limitation of syft, as the dependency depth can’t by controlled.