The build produced a software bill of materials
supply-chain/sbom-present@v1
An SBOM was produced for this build, so the components that went into the artifact are recorded rather than reconstructed later.
| Id | supply-chain/sbom-present |
| Version | v1 |
| Category | supply-chain |
| Default severity | error |
| Interpreter | python3 |
| Timeout | 30 seconds |
| Violations tolerated | 0 |
| Collects | sbom |
Collectors
This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.
| Collector | Gathers | Inputs it is given |
|---|---|---|
sbom | The components a build says it ships, read from the bill of materials it already wrote, whether that is CycloneDX or SPDX, JSON, XML or tag-value, normalized into one list carrying the licence each component names. | none |
The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.
Configuration
{
"guardrails": {
"failOn": "error",
"comment": true,
"checks": [
{
"use": "supply-chain/sbom-present@v1",
"severity": "error",
"with": {
"minComponents": "1"
},
"exemptions": []
}
]
}
}Inputs
| Input | Description | Default | Environment variable |
|---|---|---|---|
minComponents | Fewest components an SBOM must name to count. A document naming nothing is a file, not an inventory. | 1 | GUARDRAIL_INPUT_MINCOMPONENTS |
How to fix
Generate an SBOM in the pipeline and leave it in the workspace before buildnote guardrails runs:
syft dir:. -o cyclonedx-json=bom.jsonGradle and Maven have plugins that write one from the resolved graph, which is more accurate than scanning the tree. An absent SBOM is the violation: the question this answers is "which releases contain package X at version Y", and it is asked on the day the next Log4Shell lands, when reconstructing it is far too slow.
More in supply-chain
supply-chain/components-licensed. Enough of the components the bill of materials lists name a licence that the inventory can answer what the artifact may be distributed under.supply-chain/disallowed-components. No component the bill of materials lists is one the team has decided it will not ship, whatever brought it in.supply-chain/disallowed-licenses. No component the bill of materials lists is licensed under one of the licences the team has decided it will not ship.supply-chain/no-critical-vulnerabilities. No dependency the build takes on carries an open finding at or above the severity the team gates on.supply-chain/sbom-standard-format. The bill of materials is written in a format anything else can read, and it declares which version of that format it is.