SBOM — v0.1.28

Software Bill of Materials for CocoIndex Code Plus v0.1.28.

Published here — on the public docs repo — so it can be fetched with no
credentials: the container images themselves are private.

Asset	Contents
ccx-{indexer,query-server}-0.1.28-linux-{amd64,arm64}.{spdx,cdx}.json	Full image contents: Debian packages from python:3.11-slim + every Python distribution in the runtime venv. One per platform — they differ.
cocoindex-code-plus-0.1.28.{spdx,cdx}.json	The ccx CLI as resolved from PyPI at release time.
THIRD_PARTY_NOTICES-cocoindex-plus-0.1.28.html	License attribution for the Rust crate tree compiled into the CocoIndex Plus engine (see scope note).
chart-third-party-images-0.1.28.txt	Optional upstream images the Helm chart can deploy.

Both SPDX 2.3 and CycloneDX are provided; they describe the same artifacts.

Verify

cosign verify-blob SHA256SUMS --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity-regexp '^https://github\.com/cocoindex-io/cocoindex-code-plus/\.github/workflows/release\.yml@refs/tags/v.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS

Scope note

The CocoIndex Plus engine ships as a compiled extension module, so
scanners resolve it to one component (cocoindex-plus) rather than to
the Rust crates inside it. The notices file above is the attribution
record for that subtree.

Customers with image pull access can instead read the SPDX attestation
attached to each image digest at build time:
docker buildx imagetools inspect <image>:0.1.28 --format '{{ json .SBOM }}'.