The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the SPDX specification and serialized as a JSON file.
Accessing the SBOM
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:
| Parameter | Possible values |
|---|---|
| edition | pro, farm, free |
| version | e.g. 5.1, 5.4.3 |
| service | Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,... |
First, pull the application image for the desired edition and version:
docker pull docker.bluespice.com/bluespice-$edition/wiki:$version
Then, inspect the attachments with ORAS (oras requires login data):
oras discover docker.bluespice.com/bluespice-$edition/wiki:$version
Do the same for service images:
Pull the image:
docker pull docker.bluespice.com/bluespice/$service:$version
Inspect the attachments:
oras discover docker.bluespice.com/bluespice/$service:$version
Example:
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"
Download the attachments (provide the actual sha of the attachment, e.g. 3d7b0e...58 from the example):
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
or for services:
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
The SBOM file is located in your current folder as sbom.json.
You can now scan your SBOM files. Below is a scanning example for Trivy:
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
