Shipping SBOMs with Your Components

Tue, 28 Jul 2026 10:00:00 +0200

The Problem

OCM already tells you which artifacts a component delivers: its Software Bill of Delivery. But that does not answer the question a security team actually has: “which dependencies are bundled inside those artifacts, and am I affected by this vulnerability?” Knowing a component ships an OCI image and a CLI binary as a resource does not tell anything about the packages and libraries buried inside that resource.

Sbom on Open Component Model

Shipping SBOMs with Your Components

The Problem