Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a complete, structured inventory of all software packages, libraries, and dependencies contained within a built image. ImageFactory automatically collects this information during the build process, providing you with deep visibility into the software supply chain of your golden images.

Overview

In modern cloud environments, understanding the exact composition of your images is critical for security and compliance. ImageFactory's SBOM feature allows you to:

• Identify all installed OS packages and their versions.
• Track changes in software composition between consecutive builds.
• Verify that images meet organizational security standards before deployment.

How SBOMs are Generated

ImageFactory generates SBOM data as part of the image build lifecycle. The SBOM files are produced in SPDX 2.3 JSON format, which is a widely adopted standard for software bill of materials that ensures compatibility with various security and compliance tools.

1. Collection: During the build phase, ImageFactory executes specialized discovery components that query the package manager of the target operating system (e.g., apt, yum, dnf, or Windows Get-Package).
2. Storage: The collected package information is stored in a structured format within the ImageFactory database.
3. On-Demand Assembly: The final SBOM file is generated on-demand when it is first requested via the API. This ensures that the SBOM reflects the most accurate state of the image.
4. Caching: Once generated, the SBOM file is stored securely and a temporary download URL is cached on the image record for subsequent access.

Accessing SBOM Data

You can view SBOM information directly in the Web UI, or retrieve it through the GraphQL API.

Using the Web Interface

Navigate to a template's detail page, select an image build, and open the Inventory tab. From here you can view the full package inventory, download the SBOM file, and review the change log comparing this build to the previous one.

For a detailed walkthrough of the image detail view, see the Template Details guide.

Via API

Via API

To access the SBOM programmatically, query the image with the presign parameter set to true:

query {
  image(
    customerId: "your-customer-id"
    templateId: "your-template-id"
    imageId: "your-image-id"
    presign: true
  ) {
    id
    name
    details {
      sbom
      packageInventory
      changeLog
    }
  }
}

The sbom field returns a temporary download URL where the full SBOM file can be downloaded.

SPDX 2.3 Format

ImageFactory generates SBOMs in SPDX 2.3 JSON format, which is an industry-standard format maintained by the Linux Foundation. The SPDX format provides a structured way to communicate software component information and is widely supported by security scanning tools and compliance platforms.

SPDX Document Structure

Each SBOM file contains:

• Document Information: Metadata about the SBOM itself, including creation timestamp and SPDX version.
• Packages: A list of all software packages installed on the image, each with:
  • Unique SPDX identifier (e.g., SPDXRef-openssl)
  • Package name and version
  • Download location (set to NOASSERTION for OS packages)
  • Primary package purpose (typically LIBRARY)
• Relationships: Describes how packages relate to the document (using DESCRIBES relationship type).

Example SPDX Output

{
  "SPDXID": "SPDXRef-DOCUMENT",
  "spdxVersion": "SPDX-2.3",
  "creationInfo": {
    "created": "2026-04-22T07:30:00Z",
    "creators": ["Tool: ImageFactory SBOM Generator"]
  },
  "name": "ubuntu-22.04-image",
  "dataLicense": "CC0-1.0",
  "documentNamespace": "https://spdx.org/spdxdocs/SPDXRef-DOCUMENT-abc123",
  "packages": [
    {
      "SPDXID": "SPDXRef-openssl",
      "name": "openssl",
      "versionInfo": "3.0.2-0ubuntu1.10",
      "downloadLocation": "NOASSERTION",
      "filesAnalyzed": true,
      "primaryPackagePurpose": "LIBRARY"
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-openssl",
      "relationshipType": "DESCRIBES"
    }
  ]
}

Package Inventory

For quick programmatic access without downloading the full SBOM file, ImageFactory provides a summary of installed packages in the details.package_inventory field of the image record.

{
  "package_inventory": [
    {
      "name": "openssl",
      "version": "3.0.2-0ubuntu1.10",
      "architecture": "amd64"
    },
    {
      "name": "kernel",
      "version": "5.15.0-76-generic",
      "architecture": "x86_64"
    }
  ]
}

Change Log

ImageFactory also generates a diff comparison between the current image and the previous successful build from the same template. This is available in the details.change_log field.

Action	Package	Version
ADDED	python3-pip	22.0.2
UPDATED	curl	7.81.0 -> 7.81.1
REMOVED	telnet	0.17

Use Cases

Vulnerability Management

By providing a machine-readable list of all software components, SBOMs enable security teams to quickly identify images affected by newly discovered vulnerabilities (CVEs). You can cross-reference your SBOMs with vulnerability databases to automate risk assessment.

License Compliance

Ensure that your golden images do not contain software with restrictive or incompatible licenses. SBOMs provide the necessary data to perform automated license audits across your entire image catalog.

Supply Chain Security

Verify the integrity of your software supply chain by tracking the origin and version of every package included in your images. This helps prevent the introduction of malicious or unauthorized software.

Regulatory Requirements

Many industries and government agencies now require an SBOM as part of the software procurement and deployment process. ImageFactory helps you meet these regulatory requirements with minimal effort.

Best Practices

• Automate Retrieval: Integrate SBOM retrieval into your CI/CD pipeline to automatically scan images for vulnerabilities before they are promoted to production.
• Review Change Logs: Always check the change log for unexpected package additions or removals, which could indicate a configuration error or a security issue.
• Archive SBOMs: While ImageFactory stores SBOM data, consider archiving the generated SBOM files in your own long-term storage for historical compliance records.