Image SBOM and Vulnerability Pull
A 3-step recipe with Anchore. We can help you get access.
Recipe · 3 steps
Image SBOM and Vulnerability Pull
with Anchore · Vulnerability Management
Verify analysis, then export the SBOM and vulnerability report for an image.
- Read the image record and branch on analysisStatus. Continue to the SBOM export only when the image has finished analysis.
- Retrieve the CycloneDX Software Bill of Materials for the analyzed image.
- Retrieve the vulnerability report so it can be filed alongside the SBOM as compliance evidence.
What you'll need to have ready
- authorization: HTTP Basic authorization header value (e.g. "Basic dXNlcjpwYXNz").
- imageDigest: The SHA256 digest of the image to export evidence for.
- vtype: Vulnerability type to report (os, non-os, or all). Defaults to all.
For your developer
Arazzo workflow anchore:image-sbom-and-vulns, 3 operations: getImage → getImageSbom → getImageVulnerabilities. Specs on APIs.io.