SeeBOM 0.3.1

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.3.1
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.3.1
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.3.1
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.3.1
docker pull ghcr.io/seebom-labs/seebom/ui:0.3.1

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.3.1

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.3.1

SBOM

An SPDX SBOM for this release is attached as seebom-0.3.1.spdx.json.

What's Changed

🔧 Maintenance

• security: improve OpenSSF Scorecard (pin images, sign releases, fix vulns) by @mfahlandt in #106
• fix: correct mikebom binary path in release workflow by @mfahlandt in #107
• fix: revert to anchore/sbom-action for SBOM generation by @mfahlandt in #108

Full Changelog: v0.3.0...v0.3.1