Skip to content
Entropy Data

SBOM

Self-hosted

A Software Bill of Materials (SBOM) is a detailed inventory or list of all the components, libraries, dependencies, and software used within a specific application or system. It provides critical transparency into the makeup of software.

As a fundamental security concept, we create an SBOM (Software Bill of Material) for the software, including all libraries and Docker base image, and attach it to the provided container. You can extract the SBOM from the container and integrate the SBOM into your internal security check procedures, if applicable.

Verify the signature

Our released container images are signed with cosign using keyless Sigstore signing. There is no public key to distribute: the signature is bound to the GitHub Actions workflow that built the image, and verification checks that identity against the public Sigstore transparency log.

cosign verify entropydata/entropy-data:latest \
  --certificate-identity-regexp '^https://github\.com/datamesh-manager/entropy-data/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The signature covers the image index, which in turn commits to the per-platform manifests and to the SBOM and provenance attestations. So a successful verification tells you the SBOM you read in the next section is the one we published, and that it has not been swapped or retagged.

To inspect the build provenance attached to the same index:

docker buildx imagetools inspect entropydata/entropy-data:latest \
  --format '{{ json .Provenance }}'

Image signing was introduced in August 2026. Releases published before then carry an SBOM but no signature, and cosign verify will fail on them with no matching signatures. This is expected for older tags rather than a sign of tampering.

Substitute the image you actually run — entropydata/entropy-data-ce, datameshmanager/datamesh-manager, datameshmanager/datamesh-manager-ce, or datacontractmanager/datacontract-manager-ce. The images mirrored to public.ecr.aws/s4e5k7s9 carry the same signatures.

View SBOM

Use Syft to view all the components included in the application. It supports different output formats.

syft entropydata/entropy-data:latest
syft entropydata/entropy-data:latest -o spdx-json
syft entropydata/entropy-data:latest -o cyclonedx-xml

The docker sbom command is deprecated and has been removed from recent Docker Desktop releases. Call syft directly instead. If you see an error like client version 1.41 is too old, your Syft version predates your Docker daemon's API — upgrade Syft (brew upgrade syft or re-run the install script) and re-run the command.

Scan for vulnerabilities

The SBOM is an inventory, not a vulnerability report. Feed it to the scanner you already use — Grype pairs directly with Syft:

syft entropydata/entropy-data:latest -o spdx-json > sbom.json
grype sbom:sbom.json

If you scan with Trivy, be aware that it does not detect this base image. Alpaquita keeps its package database at /var/lib/apk/db/installed rather than the path Trivy looks in, so trivy image reports OS: NOT DETECTED and silently leaves out the Java runtime, glibc and OpenSSL — from both its scan results and its SBOM export. An empty operating-system section is a limitation of the tool rather than a clean bill of health.