Versions Compared

Old Version 2

changes.mady.by.user Derek Johnson

Saved on

compared with

New Version Current

changes.mady.by.user Derek Johnson

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

  Each Cirrus Link module now ships with a Software Bill of Materials (SBOM) bundled directly inside the .modl file. The SBOM is a complete, machine-readable inventory of the third-party components     

  included in the module, provided in the industry-standard CycloneDX format (JSON, schema 1.6).                                                                                                          

                                                                                                                                                                                                          

  The SBOM supports your supply-chain security and compliance workflows  vulnerability scanning, license review, and audit, without needing to install or run the module.


Info
Because it's packaged inside

...

the signed .modl, it's covered by the module's code signature and travels with the module wherever it goes.

...

       

...

                                                                                                                                                                                                           

How to retrieve 

  1. To retrieve it, treat the .modl as a standard archive and extract the SBOM from its root:

...

  1.                                                                                                                                                                                                

...

  1.   

...

  1. unzip -j MyModule-signed.modl "*-SBOM.json"

...

  1.          

...

  1.                                                                                                                                                                                        

...

  1.   

...

  1. The file is named <ModuleName>-SBOM.json and can be loaded into any CycloneDX-compatible tool (e.g. Dependency-Track, Grype, or cyclonedx CLI).