1"use strict";(globalThis.webpackChunkwitness_website=globalThis.webpackChunkwitness_website||[]).push([[5016],{1149(t,e,s){s.r(e),s.d(e,{assets:()=>i,contentTitle:()=>c,default:()=>l,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var o=s(4848),n=s(8453);const r={},c="SBOM Attestor",a={id:"docs/attestors/sbom",title:"SBOM Attestor",description:"The SBOM attestor records the contents of any products that are valid CycloneDX or SPDX json files. The SBOM file is parsed and the contents are recorded in the attestation.",source:"@site/../docs/attestors/sbom.md",sourceDirName:"docs/attestors",slug:"/docs/attestors/sbom",permalink:"/docs/docs/attestors/sbom",draft:!1,unlisted:!1,tags:[],version:"current",frontMatter:{},sidebar:"docsSidebar",previous:{title:"Sarif Attestor",permalink:"/docs/docs/attestors/sarif"},next:{title:"Secretscan Attestor",permalink:"/docs/docs/attestors/secretscan"}},i={},d=[{value:"Schema",id:"schema",level:2}];function h(t){const e={a:"a",code:"code",h1:"h1",h2:"h2",p:"p",pre:"pre",...(0,n.R)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h1,{id:"sbom-attestor",children:"SBOM Attestor"}),"\n",(0,o.jsxs)(e.p,{children:["The SBOM attestor records the contents of any ",(0,o.jsx)(e.a,{href:"/docs/docs/attestors/product",children:"products"})," that are valid ",(0,o.jsx)(e.a,{href:"https://cyclonedx.org/specification/overview/",children:"CycloneDX"})," or ",(0,o.jsx)(e.a,{href:"https://spdx.dev/learn/overview/",children:"SPDX"})," json files. The SBOM file is parsed and the contents are recorded in the attestation."]}),"\n",(0,o.jsx)(e.h2,{id:"schema",children:"Schema"}),"\n",(0,o.jsx)(e.pre,{children:(0,o.jsx)(e.code,{className:"language-json",children:'{\n "$schema": "https://json-schema.org/draft/2020-12/schema",\n "$id": "https://github.com/in-toto/go-witness/attestation/sbom/sbom-attestor",\n "$ref": "#/$defs/SBOMAttestor",\n "$defs": {\n "SBOMAttestor": {\n "properties": {\n "SBOMDocument": true\n },\n "additionalProperties": false,\n "type": "object",\n "required": [\n "SBOMDocument"\n ]\n }\n }\n}\n'})})]})}function l(t={}){const{wrapper:e}={...(0,n.R)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(h,{...t})}):h(t)}},8453(t,e,s){s.d(e,{R:()=>c,x:()=>a});var o=s(6540);const n={},r=o.createContext(n);function c(t){const e=o.useContext(r);return o.useMemo(function(){return"function"==typeof t?t(e):{...e,...t}},[e,t])}function a(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(n):t.components||n:c(t.components),o.createElement(r.Provider,{value:e},t.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.