You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cli/how-tos/fetch_sboms.mdx
+21-5Lines changed: 21 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,12 +6,28 @@ To retrieve the SBOMs for a specific release, you can use the `src` command line
6
6
7
7
1. Install `src` by following the [Quickstart](../quickstart.mdx).
8
8
2. Install `cosign` by following the [Installation Guide](https://docs.sigstore.dev/cosign/system_config/installation/).
9
-
3. Identify your Sourcegraph instance's version - you can do this by checking your deployment, or visiting the Settings page on your Sourcegraph instance at and checking the version shown in the bottom left corner.
9
+
3. Identify the version of Sourcegraph your require SBOMs for. This may be a [recent release](../../CHANGELOG.mdx), or your instance's current version.
10
+
1. SBOMs are only available for Sourcegraph release 5.8.[TODO] and later.
11
+
2. Find your instance's current version by checking your deployment, or by visiting the Settings page on your Sourcegraph instance and checking the version shown in the bottom left corner.
4. Run `src sbom fetch -v <version>` to fetch SBOMs for all containers in this release. `src` will automatically validate that all SBOMs were signed by Sourcegraph.
11
-
```bash
12
-
# Fetch SBOMs for Sourcegraph release 5.8.123
13
-
$ src sbom fetch -v 5.8.123
14
-
```
14
+
```
15
+
# Fetch SBOMs for Sourcegraph release 5.8.123
16
+
$ src sbom fetch -v 5.8.123
17
+
18
+
Fetching SBOMs and validating signatures for all 55 images in the Sourcegraph 5.8.123 release...
Fetched and validated SBOMs have been written to `sourcegraph-sboms/sourcegraph-5.8.123`.
28
+
29
+
Your Sourcegraph deployment may not use all of these images. Please check your deployment to confirm which images are used.
30
+
```
15
31
5. Once completed, you can find the set of validated SBOMs under `sourcegraph-sboms/sourcegraph-<version>/`.
16
32
17
33
**Note:**`src sbom fetch` will retrieve SBOMs for **all** containers that make up a Sourcegraph release. Your Sourcegraph instance will use only a subset of these containers - please check your deployment to determine which SBOM files are relevant to your deployment.
0 commit comments