Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Software Bill of Materials

A Software Bill of Materials (SBOM) is a machine-readable inventory of the components and dependencies included in a software release. It helps you understand what is included in a build and assess potential security or compliance risks.

Starting with version 8.3, every Percona Server for MongoDB (PSMDB) release includes a CycloneDX SBOM in JSON format.

Why it matters

An SBOM helps you:

  • Identify the components and dependencies included in a PSMDB release.
  • Assess known vulnerabilities using SBOM-compatible security scanners.
  • Support security reviews, compliance processes, and software supply chain requirements.
  • Verify the contents of deployed software artifacts.

Where to find the SBOM

Distribution method SBOM location
Binary tarball doc/percona-server-mongodb/sbom.cdx.json
RPM package /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json
DEB package /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json
Docker image Embedded in the image and available as an attached OCI artifact. See Docker images.

Verifying and scanning the SBOM

The examples below use Grype .

Note

Trivy cannot currently scan the SBOMs included with Percona Server for MongoDB DEB and RPM packages or binary tarballs. Most dependencies in these SBOMs are identified using the GitHub package type, which Trivy does not fully support in this context.

Trivy can, however, scan the SBOMs associated with Percona Server for MongoDB Docker images.

Binary tarball

# Confirm the SBOM is bundled
tar tzf percona-server-mongodb-8.0.26-11-x86_64.<operating-system>.tar.gz | grep sbom.cdx.json

# Extract and scan
tar xzf percona-server-mongodb-8.0.26-11-x86_64.<operating-system>.tar.gz \
    -C /tmp doc/sbom.cdx.json
grype sbom:/tmp/doc/sbom.cdx.json

RPM package

# Confirm the package installs the SBOM
rpm -ql percona-server-mongodb-server | grep sbom.cdx.json

# Scan it (replace 9.x with your RHEL/OL version)
grype sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json

DEB package

# Confirm the package installs the SBOM
dpkg -L percona-server-mongodb-server | grep sbom.cdx.json

# Scan it
grype sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json

Docker images

Each PSMDB Docker image (Docker Hub docker.io/percona/percona-server-mongodb-server, PerconaLab docker.io/perconalab/percona-server-mongodb-server) ships with two CycloneDX SBOMs that describe overlapping scopes:

SBOM Scope CyclonDX version How to access
Embedded PSMDB packages only 1.5 Inside the image filesystem
OCI-attached Full image — PSMDB and UBI9 base OS packages 1.6 Registry-side, via the OCI Referrers API

trivy image --sbom-sources oci fetches the attached SBOM via the OCI Referrers API and scans it, without pulling the image:

trivy image --severity HIGH,CRITICAL --ignore-unfixed --sbom-sources oci \
    docker.io/percona/percona-server-mongodb-server

Scan the embedded SBOM

To scan the embedded SBOM from inside the container image:

docker run --rm -it --entrypoint cat \
    docker.io/percona/percona-server-mongodb \
    /usr/share/doc/percona-server-mongodb/sbom.cdx.json \
    | grype --from sbom

Advanced: Inspect OCI-attached SBOMs with ORAS

You can use the ORAS CLI to discover and download OCI-attached SBOMs.

# Use the per-architecture tag to resolve directly to the image manifest
oras discover --format tree \
    docker.io/percona/percona-server-mongodb-amd64

# Pull the SBOM artifact using the digest from the discover output
oras pull docker.io/percona/percona-server-mongodb@sha256:<referrer-digest>