SBOM requirements for Red Hat Trusted Profile Analyzer

Red Hat Trusted Profile Analyzer must have SBOM or advisory data keyed to the image digests your devices report. You can generate compliant SBOMs during Red Hat Edge Manager image builds, or supply SBOMs from your CI/CD pipeline.

SBOMs from the image builder
Copy link

When you build operating system images with the Red Hat Edge Manager image builder, the builder generates SBOMs automatically in CycloneDX JSON format. The builder stores the image digest in metadata.component, so Red Hat Trusted Profile Analyzer can correlate findings with enrolled devices.

For image builder workflows, see Operating system images for Red Hat Edge Manager in the Additional resources section.

Manual SBOM import
Copy link

When you upload SBOMs to Red Hat Trusted Profile Analyzer outside the image builder, use CycloneDX JSON (version 1.4 or later). Include the image digest in metadata.component as in the following example:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": {
    "component": {
      "type": "container",
      "name": "quay.io/example/my-image:v1.0.0",
      "version": "v1.0.0",
      "purl": "pkg:oci/example/my-image@sha256:abc123...?repository_url=quay.io",
      "bom-ref": "pkg:oci/example/my-image@sha256:abc123..."
    }
  },
  "components": []
}
Field Requirement

metadata.component.type

Must be container for container images.

metadata.component.name

Full image reference (registry, name, and tag).

metadata.component.purl

OCI Package URL with digest: pkg:oci/<name>@sha256:<digest>?repository_url=<registry> in canonical (unencoded) form.

Generate SBOMs with syft when images are built in CI/CD:

$ syft <image_reference> -o cyclonedx-json > sbom.json

Verify metadata.component.purl contains the digest before you upload the SBOM to Red Hat Trusted Profile Analyzer.

Red Hat Trusted Profile Analyzer instance
Copy link

Deploy Red Hat Trusted Profile Analyzer so that the flightctl-periodic service can reach it over HTTPS. You can run Red Hat Trusted Profile Analyzer alongside Red Hat Edge Manager or use an existing instance. For deployment instructions, see Red Hat Trusted Profile Analyzer documentation in the Additional resources section.