---
icon: material/package-variant-closed-check
title: "SBOM"
description: "The stable address for 10x Engine software bills of materials: CycloneDX JSON, one per engine flavor, published as a public asset on every release."
---

# SBOM

Every 10x Engine release publishes a CycloneDX software bill of materials
for each engine flavor, as a public release asset. This page is the address
that does not change when the version does.

| Property | Value |
|----------|-------|
| Format | CycloneDX JSON, spec 1.6 |
| Generated by | `cyclonedx-gradle-plugin` 2.3.1, in the release build |
| Files per release | Three, one per flavor |
| Published since | 1.1.73 |
| Authentication | None. Public assets on a public repository |
| Latest release | [pipeline-releases](https://github.com/log-10x/pipeline-releases/releases/latest){target="_blank"} |

## :material-file-tree: Flavors

| Flavor | Asset | Covers |
|--------|-------|--------|
| Edge | `sbom-run-edge-<version>.cdx.json` | The Reporter and Receiver runtime, the smallest dependency set |
| Cloud | `sbom-run-cloud-<version>.cdx.json` | The full cloud runtime, including the analyzer inputs |
| Lambda | `sbom-run-lambda-<version>.cdx.json` | The Lambda layer and the Retriever handler |

At 1.1.73 those carry 124, 257 and 237 components.

## :material-download: Fetching the latest

Asset names carry the version, so a durable fetch resolves the release
first. No token is needed.

=== ":material-console: curl"

    ```bash
    # Every SBOM from the latest release, into the working directory.
    curl -s https://api.github.com/repos/log-10x/pipeline-releases/releases/latest \
      | grep -o 'https://[^"]*\.cdx\.json' \
      | xargs -n1 curl -sLO
    ```

=== ":simple-github: gh"

    ```bash
    gh release download --repo log-10x/pipeline-releases \
      --pattern '*.cdx.json'
    ```

=== ":material-tag: A specific version"

    ```bash
    VERSION=1.1.73
    curl -sLO "https://github.com/log-10x/pipeline-releases/releases/download/$VERSION/sbom-run-edge-$VERSION.cdx.json"
    ```

## :material-magnify-scan: Scanning one

CycloneDX JSON is the input format for the common scanners, so no
conversion step is needed.

```bash
grype sbom:./sbom-run-edge-1.1.73.cdx.json
trivy sbom ./sbom-run-edge-1.1.73.cdx.json
```

## :material-shield-bug-outline: Reporting a finding

A vulnerability you find by scanning one of these files goes to
[security@log10x.com](mailto:security@log10x.com), on the same response and
remediation targets as any other report:
[Report a vulnerability](index.md#report-a-vulnerability).