The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the SPDX specification and serialized as a JSON file.
Accessing the SBOM
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:
| Parameter | Possible values |
|---|---|
| edition | pro, farm, free
|
| version | e.g. 5.1, 5.2.6
|
| service | Services differ depending on edition and version. Common services are:
|
Main application image
Pull the application image for the desired edition and version:
docker pull docker.bluespice.com/bluespice-$edition/wiki:$version
Inspect the attachments with ORAS (oras requires login data):
oras discover docker.bluespice.com/bluespice-$edition/wiki:$version
Example output:
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"
Download the attachments (provide the actual sha of the attachment, e.g. 3d7b0e...58 from the example):
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
Companion service images
Pull the image for the desired version:
docker pull docker.bluespice.com/bluespice/$service:$version
Inspect the attachments:
oras discover docker.bluespice.com/bluespice/$service:$version
Download the attachments (provide the actual sha of the attachment)
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
Perform a security scan
The previous commands have created a sbom.json file in the local directory. You can now scan it. Below is a scanning example for trivy:
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
