Inventory and SBOM handoff

Use a configuration inventory to identify the images and charts an installation can deploy. Use package SBOMs to inspect software inside specific published images or the deployment CLI. Neither is a live-cluster inventory or a vulnerability assessment by itself.

Generate the configuration inventory

Run from an authorized bsqai-platform tooling checkout. The inventory tooling uses Python 3.12, uv, Git, Helm 4.2.1, Kustomize 5.8.1, and ORAS 1.3.2. Authenticate to the configured registry with pull access first. No Kubernetes connection is needed.

uv sync --locked --no-dev
export INVENTORY_REGISTRY="<registry-host>"
export INVENTORY_CHART_REPOSITORY="coreai/helm"
export INVENTORY_REGISTRY_CONFIG="$HOME/.docker/config.json"
export INVENTORY_OUTPUT="sbom/site-release"

uv run python scripts/generate_platform_inventory.py \
  --registry "$INVENTORY_REGISTRY" \
  --helm-repository "$INVENTORY_CHART_REPOSITORY" \
  --registry-config "$INVENTORY_REGISTRY_CONFIG" \
  --resolve-digests \
  --api-version monitoring.coreos.com/v1 \
  --api-version monitoring.coreos.com/v1/PodMonitor \
  --api-version monitoring.coreos.com/v1/ServiceMonitor \
  --output-dir "$INVENTORY_OUTPUT"

Use a fresh output directory for every run. Select the correct source checkout and site configuration before interpreting the results:

• Normal shell overrides apply. Add --load-env to load the site's dotenv files; they are otherwise ignored.
• Add --include-platform-variants to cover exposed feature, CPU/GPU, and storage alternatives. This does not enumerate arbitrary user workloads or every possible chart override.
• Set --kube-version and repeated --api-version values to the target's capabilities. The example includes monitoring APIs, not a complete description of every site.
• Use --source <release-checkout> to inspect another release with current tooling and the source release's Python environment. --requested-ref <release-tag> labels the output; it does not check out that release.

With repository access, the Generate Platform Image Inventory GitHub Actions workflow provides the same inventory as a downloadable artifact. Select the release and configuration coverage required for the handoff.

Check completeness

jq '{handoff_complete, errors}' "$INVENTORY_OUTPUT/platform-inventory.json"
(cd "$INVENTORY_OUTPUT" && sha256sum --check SHA256SUMS)

Read the generated README and any unresolved controller_image_selection entries. handoff_complete must be true before presenting the bundle as complete. Failed runs can contain useful partial diagnostics, but a file list alone does not prove coverage. Fix unresolved access, rendering, or image-selection problems and rerun into a fresh directory.

Resolved digests reflect the registry at collection time. They do not reconstruct the historical contents of a mutable tag or prove which digest a running cluster uses.

Download package SBOMs

Obtain the package reports for the component versions selected by the platform release. Authorized repository users can download them from the component's release assets; disconnected recipients receive the same files in the delivery bundle.

For example, to retrieve the Portal report with GitHub CLI access, use the exact component release tag and the asset version shown on that release:

export COMPONENT_RELEASE_TAG="<portal-release-tag>"
export COMPONENT_ASSET_VERSION="<asset-version>"
export SBOM_DOWNLOAD="sbom/portal-release"

gh release download "$COMPONENT_RELEASE_TAG" \
  --repo BSQAI/platform-portal \
  --pattern "portal-sbom-$COMPONENT_ASSET_VERSION.tar.gz*" \
  --dir "$SBOM_DOWNLOAD"

(cd "$SBOM_DOWNLOAD" && sha256sum --check "portal-sbom-$COMPONENT_ASSET_VERSION.tar.gz.sha256")
tar -xzf "$SBOM_DOWNLOAD/portal-sbom-$COMPONENT_ASSET_VERSION.tar.gz" -C "$SBOM_DOWNLOAD"
(cd "$SBOM_DOWNLOAD/portal-sbom" && sha256sum --check SHA256SUMS)

Use a fresh trusted download directory. Check the archive checksum before extraction and the bundle's SHA256SUMS afterward. Compare the bundle manifest's published image digest and architecture-specific entries with the configuration inventory and the delivered images. A package SBOM for another digest or architecture is not evidence for the selected image.

Checksum validation detects changed files; it does not independently authenticate their publisher. Obtain artifacts through the approved release or delivery channel.

Prepare the handoff

Include the source commit and release selection, configuration coverage, inventory outputs, matching package SBOMs, checksums, and any unresolved findings. Keep credential files and tokens out of the bundle. Record the image digests delivered to a mirror so downstream scanning targets the same content.

The platform CLI SBOM describes its packaged Python environment, not every platform workload. Inventory and SBOM coverage should remain explicit when a security team assesses third-party components or customer-added workloads.

Related pages

• Platform CLI
• Configuration model
• Artifact delivery with Harbor
• Upgrade and release process