Skip to content

Commit a6e288e

Browse files
Anthony EmengoAidanDelaney
authored andcommitted
Address PR comments
* Make statements less difficult to misinterpret Thanks for the PR Review: @AidanDelaney Signed-off-by: Anthony Emengo <[email protected]>
1 parent 697d52f commit a6e288e

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

content/docs/features/bill-of-materials.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ summary="A Software `Structured Bill-of-Materials` (`SBoM`) gives you a layer-by
55

66
## Summary
77

8-
A Software **Structured-Bill-of-Materials** (`SBoM`) provides information necessary to know what's inside your container and how it was constructed.
8+
A **Structured-Bill-of-Materials** (`SBoM`) provides information necessary to know what's inside your container and how it was constructed.
99
Cloud Native Buildpacks provides Structured-Bill-of-Materials in either CycloneDX, SPDX, or Syft format.
1010

1111
1. Buildpacks can populate `SBoM` information about the dependencies they have provided.
@@ -18,7 +18,7 @@ Use the following tutorial to add a `Bill-of-Materials` using buildpacks. <br/>
1818

1919
## Viewing Bill of Materials
2020

21-
You can use the `download-sbom` command to inspect your app for it's `Structured-Bill-of-Materials`. The following command will download the application layer containing the `SBoM` files to `./layers/sbom/...`.
21+
You can use the `download-sbom` command to inspect your app for its `Structured-Bill-of-Materials`. The following command will download the application layer containing the `SBoM` files to `./layers/sbom/...` on your local filesystem.
2222

2323
```bash
2424
pack download-sbom your-image-name
@@ -30,7 +30,7 @@ You can also choose to download the `SBoM` from an image hosted in a remote regi
3030
pack download-sbom your-image-name --remote
3131
```
3232

33-
The following is a sample directory structure for an `SBoM` layer downloaded to the local filesystem. The files are named in the following pattern `sbom.<FORMAT>.json`, where FORMAT can be one of the Structured-Bill-of-Material formats allowed by Cloud Native Buildpacks tooling: `cdx`, `spdx`, or `syft`. Buildpack authors may choose to generate `SBoM` for the entire buildpack, or individual layers designated by the buildpack.
33+
Cloud Native Buildpacks support `SBoM` metadata in [CycloneDX](https://cyclonedx.org/), [Syft](https://github.com/anchore/syft) or [Spdx](https://spdx.dev/) formats. The following example demonstrates `syft` format `SBoM` metadata to the local filesystem. The combined metadata from all of the `sbom.syft.json` files is the image `SBoM`. Where CycloneDX `SBoM` metadata is generated, the files are named `sbom.cdx.json`. Similarly, Spdx files are named `sbom.cdx.json`.
3434

3535
```bash
3636
.

0 commit comments

Comments
 (0)