You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
mix.lock has exact versions + checksums for the Hex dependency tree, but it's not a real SBOM - wrong format (Erlang-term syntax, not SPDX/CycloneDX), no license data, and doesn't cover the OTP/ERTS runtime Burrito bundles into each binary or the Alpine packages baked into the container image.
Three pieces, kept as separate files since a container SBOM has no use to anyone not using the container:
App + Hex deps + Erlang/OTP + Elixir runtime -> erlef/mix_sbom (verified: includes the OTP standard library apps - kernel/stdlib/crypto/ssl/etc - and Elixir at the exact pinned version by default, no manual merge needed). Generated in the burrito job, attached to the GitHub release as sbom.cdx.json in the same atomic gh release create call that creates the release.
Container image OS packages (Alpine/apk) -> aquasecurity/trivy-action, --format cyclonedx. Generated in the container job, which runs after the release is already published (and thus immutable, Releases ship with zero assets - GitHub's Immutable Releases locks them before the build finishes #18) - published as a workflow artifact, not a release asset, since it genuinely can't be attached to the already-locked release.
mix.lock has exact versions + checksums for the Hex dependency tree, but it's not a real SBOM - wrong format (Erlang-term syntax, not SPDX/CycloneDX), no license data, and doesn't cover the OTP/ERTS runtime Burrito bundles into each binary or the Alpine packages baked into the container image.
Three pieces, kept as separate files since a container SBOM has no use to anyone not using the container:
erlef/mix_sbom(verified: includes the OTP standard library apps - kernel/stdlib/crypto/ssl/etc - and Elixir at the exact pinned version by default, no manual merge needed). Generated in the burrito job, attached to the GitHub release assbom.cdx.jsonin the same atomicgh release createcall that creates the release.aquasecurity/trivy-action,--format cyclonedx. Generated in the container job, which runs after the release is already published (and thus immutable, Releases ship with zero assets - GitHub's Immutable Releases locks them before the build finishes #18) - published as a workflow artifact, not a release asset, since it genuinely can't be attached to the already-locked release.