Software Bill of Materials
Every Iotistica Agent release includes a Software Bill of Materials (SBOM) — a machine-readable inventory of every library, binary, and dependency included in that release.
SBOMs are generated automatically during the release pipeline using Syft and published in CycloneDX JSON format, a widely supported open standard for software supply chain transparency.
What is an SBOM for?
| Use case | How the SBOM helps |
|---|---|
| Vulnerability scanning | Feed the SBOM into tools like Grype, Trivy, or Dependency-Track to check for known CVEs against the exact versions shipped |
| License compliance | Audit all transitive dependency licenses in one pass without inspecting source code |
| Supply chain audits | Provide procurement teams, security reviewers, or regulators with a verifiable dependency inventory |
| Incident response | When a new CVE is disclosed, immediately determine whether a deployed version is affected |
Latest Release
| SBOM | Description | Download |
|---|---|---|
| Agent — source | All npm dependencies declared in agent/package.json, including transitive dependencies. | CycloneDX JSON ↓ |
| Agent — x86_64 build | Filesystem scan of the built x86_64 release tarball, including compiled binaries and native add-ons. | CycloneDX JSON ↓ |
| Agent — arm64 build | Filesystem scan of the built arm64 release tarball, including compiled binaries and native add-ons. | CycloneDX JSON ↓ |
| Install script | Scan of the install.sh bootstrap script. | CycloneDX JSON ↓ |
Versioned SBOMs for all past releases are available at https://apps.iotistica.com/agent/versions/{version}/sbom/.
SBOM Format
Files are in CycloneDX 1.x JSON format and can be consumed by any compatible tool:
- Grype — vulnerability scanning against CycloneDX SBOMs
- Dependency-Track — continuous SBOM monitoring and policy enforcement
- Trivy —
trivy sbom <file>scans CycloneDX and SPDX formats - OWASP Dependency-Check
# Example: scan for vulnerabilities with Grype
grype sbom:agent-source.cyclonedx.json
# Example: scan with Trivy
trivy sbom agent-source.cyclonedx.json
What each file covers
| File | Scope |
|---|---|
agent-source.cyclonedx.json | npm dependency tree from agent/package.json — all declared and transitive dependencies |
agent-artifacts-x86_64.cyclonedx.json | Filesystem scan of the built x86_64 release tarball, including compiled binaries |
agent-artifacts-arm64.cyclonedx.json | Filesystem scan of the built arm64 release tarball, including compiled binaries |
install-script.cyclonedx.json | Scan of the install.sh bootstrap script |
The source SBOM covers the npm dependency graph. The artifact SBOMs cover what is actually shipped — they may include additional components that are bundled by the build process (native add-ons, prebuilds) that don't appear in package.json.