Guardrails / supply-chain

The build produced a software bill of materials

supply-chain/sbom-present@v1

An SBOM was produced for this build, so the components that went into the artifact are recorded at build time instead of reconstructed later.

Id	supply-chain/sbom-present
Version	v1
Category	supply-chain
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	sbom

Collectors

This guardrail doesn't gather anything itself. It relies on the collectors below, which the CLI runs once per build before any check, and reads what they found from GUARDRAIL_FACTS. If a collector collects nothing, this guardrail is skipped, not failed.

Collector	Gathers	Inputs it is given
sbom	The components a build says it ships, read from the bill of materials it already wrote (CycloneDX or SPDX, in JSON, XML or tag-value) and normalized into one list with the licence each component names.	none

The inputs above are this guardrail's own inputs, passed straight through to the collector. Setting one in buildnote.json changes what is collected, and two guardrails configured the same way share a single collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "checks": [
          {
              "use": "supply-chain/sbom-present@v1",
              "severity": "error",
              "with": {
                  "minComponents": "1"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
minComponents	Fewest components an SBOM must list to count. A document that lists none is not an inventory.	1	GUARDRAIL_INPUT_MINCOMPONENTS

How to fix

Generate an SBOM in the pipeline and leave it in the workspace before buildnote guardrails runs:

syft dir:. -o cyclonedx-json=bom.json

Gradle and Maven have plugins that generate one from the resolved dependency graph, which is more accurate than scanning the file tree. A missing SBOM is the violation. An SBOM answers "which releases contain package X at version Y", a question you get asked the day the next Log4Shell lands, when reconstructing the answer is far too slow.

More in supply-chain

• supply-chain/components-licensed. Enough of the components in the bill of materials name a licence for the inventory to tell you what the artifact may be distributed under.
• supply-chain/disallowed-components. No component in the bill of materials is one the team has decided it won't ship, however it got there.
• supply-chain/disallowed-licenses. No component in the bill of materials uses a licence the team has decided it won't ship.
• supply-chain/no-critical-vulnerabilities. No dependency of the build has an open finding at or above the severity the team gates on.
• supply-chain/sbom-standard-format. The bill of materials uses a standard format other tools can read, and declares which version of that format it follows.

All 6 supply-chain guardrails