Skip to content

Commit c0f57c7

Browse files
committed
Update with suggestions
1 parent 1deba7f commit c0f57c7

File tree

1 file changed

+21
-5
lines changed

1 file changed

+21
-5
lines changed

docs/cli/how-tos/fetch_sboms.mdx

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,28 @@ To retrieve the SBOMs for a specific release, you can use the `src` command line
66

77
1. Install `src` by following the [Quickstart](../quickstart.mdx).
88
2. Install `cosign` by following the [Installation Guide](https://docs.sigstore.dev/cosign/system_config/installation/).
9-
3. Identify your Sourcegraph instance's version - you can do this by checking your deployment, or visiting the Settings page on your Sourcegraph instance at and checking the version shown in the bottom left corner.
9+
3. Identify the version of Sourcegraph your require SBOMs for. This may be a [recent release](../../CHANGELOG.mdx), or your instance's current version.
10+
1. SBOMs are only available for Sourcegraph release 5.8.[TODO] and later.
11+
2. Find your instance's current version by checking your deployment, or by visiting the Settings page on your Sourcegraph instance and checking the version shown in the bottom left corner.
12+
![](https://storage.googleapis.com/sourcegraph-assets/docs/images/settings/view-version.png)
1013
4. Run `src sbom fetch -v <version>` to fetch SBOMs for all containers in this release. `src` will automatically validate that all SBOMs were signed by Sourcegraph.
11-
```bash
12-
# Fetch SBOMs for Sourcegraph release 5.8.123
13-
$ src sbom fetch -v 5.8.123
14-
```
14+
```
15+
# Fetch SBOMs for Sourcegraph release 5.8.123
16+
$ src sbom fetch -v 5.8.123
17+
18+
Fetching SBOMs and validating signatures for all 55 images in the Sourcegraph 5.8.123 release...
19+
20+
✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/appliance
21+
✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/batcheshelper
22+
✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/bundled-executor
23+
[...]
24+
25+
🟢 Fetched verified SBOMs for 55 images
26+
27+
Fetched and validated SBOMs have been written to `sourcegraph-sboms/sourcegraph-5.8.123`.
28+
29+
Your Sourcegraph deployment may not use all of these images. Please check your deployment to confirm which images are used.
30+
```
1531
5. Once completed, you can find the set of validated SBOMs under `sourcegraph-sboms/sourcegraph-<version>/`.
1632

1733
**Note:** `src sbom fetch` will retrieve SBOMs for **all** containers that make up a Sourcegraph release. Your Sourcegraph instance will use only a subset of these containers - please check your deployment to determine which SBOM files are relevant to your deployment.

0 commit comments

Comments
 (0)