Skip to content

SBOM

Every 10x Engine release publishes a CycloneDX software bill of materials for each engine flavor, as a public release asset. This page is the address that does not change when the version does.

Property Value
Format CycloneDX JSON, spec 1.6
Generated by cyclonedx-gradle-plugin 2.3.1, in the release build
Files per release Three, one per flavor
Published since 1.1.73
Authentication None. Public assets on a public repository
Latest release pipeline-releases

Flavors

Flavor Asset Covers
Edge sbom-run-edge-<version>.cdx.json The Reporter and Receiver runtime, the smallest dependency set
Cloud sbom-run-cloud-<version>.cdx.json The full cloud runtime, including the analyzer inputs
Lambda sbom-run-lambda-<version>.cdx.json The Lambda layer and the Retriever handler

At 1.1.73 those carry 124, 257 and 237 components.

Fetching the latest

Asset names carry the version, so a durable fetch resolves the release first. No token is needed.

# Every SBOM from the latest release, into the working directory.
curl -s https://api.github.com/repos/log-10x/pipeline-releases/releases/latest \
  | grep -o 'https://[^"]*\.cdx\.json' \
  | xargs -n1 curl -sLO

gh release download --repo log-10x/pipeline-releases \
  --pattern '*.cdx.json'

VERSION=1.1.73
curl -sLO "https://github.com/log-10x/pipeline-releases/releases/download/$VERSION/sbom-run-edge-$VERSION.cdx.json"

Scanning one

CycloneDX JSON is the input format for the common scanners, so no conversion step is needed.

grype sbom:./sbom-run-edge-1.1.73.cdx.json
trivy sbom ./sbom-run-edge-1.1.73.cdx.json

Reporting a finding

A vulnerability you find by scanning one of these files goes to security@log10x.com, on the same response and remediation targets as any other report: Report a vulnerability.