PSMDB-2150 SBOMs

[rasika-chivate]

Include SBOM into PSMDB binary packages

[Copilot]

Pull request overview

Adds end-user documentation for Software Bill of Materials (SBOM) availability in Percona Server for MongoDB (PSMDB) releases and exposes it in the MkDocs navigation.

Changes:

• Adds a new documentation page describing what an SBOM is, where to find it across distribution methods, and how to verify/scan it.
• Updates MkDocs navigation to include the new SBOM documentation page under “Reference”.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
mkdocs-base.yml	Adds the SBOM page to the site navigation under Reference.
docs/sbom.md	New SBOM documentation page with locations and scanning examples (tarball/RPM/DEB/Docker).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/sbom.md:94

• The Docker embedded-SBOM scan example pipes JSON into grype --from sbom, but the rest of this page uses Grype’s sbom:<path> input form. For consistency (and to avoid a non-working flag), pipe into the SBOM source URI instead.

    | grype --from sbom

[rasika-chivate]

@ktrushin As discussed, I've not added any information for OpenVEX files. Please confirm if we need to add this.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (8)

docs/sbom.md:83

• This Trivy example uses {{ release }} while other pages use {{release}} (no spaces). For consistency (and to avoid template engines that don’t tolerate spaces), consider using the same format here.

    docker.io/percona/percona-server-mongodb:{{ release }}-amd64

docs/sbom.md:45

• These paths/tags also use {{ release }} and <os_codename>, which is inconsistent with existing placeholder usage ({{release}}, <operating-system>). Keeping placeholders consistent makes the rendered docs and examples align across pages.

tar xzf percona-server-mongodb-{{ release }}-x86_64.<os_codename>.tar.gz \
    -C /tmp percona-server-mongodb-{{ release }}-x86_64.<os_codename>/doc/sbom.cdx.json
grype sbom:/tmp/percona-server-mongodb-{{ release }}-x86_64.<os_codename>/doc/sbom.cdx.json

docs/sbom.md:88

• This inline tag uses {{ release }}; the rest of the docs typically use {{release}}. Keeping it consistent helps prevent literal {{ ... }} showing up in the rendered page.

Scan the embedded SBOM from inside the container image: `{{ release }}-amd64`:

docs/sbom.md:108

• For consistency with other examples, use {{release}} (no spaces) in this ORAS command as well.

        docker.io/percona/percona-server-mongodb:{{ release }}-amd64

docs/sbom.md:138

• This example output filename uses {{ release }}; the docs elsewhere use {{release}}. Aligning the placeholder format keeps examples consistent.

        percona-server-mongodb-{{ release }}-amd64.cdx.json

docs/sbom.md:92

• This image tag uses {{ release }} while most docs use {{release}} (no spaces). Keeping a consistent placeholder format helps avoid rendering issues and keeps examples uniform.

    docker.io/percona/percona-server-mongodb:{{ release }}-amd64 \

docs/sbom.md:39

• The tarball filename placeholder style here doesn’t match the rest of the docs (e.g., docs/install/tarball.md:7 uses {{release}} and <operating-system>). Using a different placeholder name/format risks inconsistent rendering and copy/paste mistakes.

This issue also appears in the following locations of the same file:

• line 43
• line 83
• line 88
• line 92
• line 108
• ...and 1 more

tar tzf percona-server-mongodb-{{ release }}-x86_64.<os_codename>.tar.gz \

docs/sbom.md:94

• This pipeline runs grype without a source argument, so it won’t explicitly scan the SBOM being piped from cat. Pass the SBOM as a Grype source (for example, via /dev/stdin).

    | grype --from sbom

[ktrushin]

, plus one combined document covering all releases and CVE statuses:

As discussed here, that "all realizes" VEX file can't work reliably and is better removed from the documentation.

@radoslawszulgo could you please confirm that?

[radoslawszulgo]

confirm. Let's remove these references in docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

docs/sbom.md:158

• These commands download and reference percona-server-mongodb-{{ release }}.vex.json, but the URL above uses .openvex.json. Align the commands with the published filename so users can copy/paste the example successfully.

# Download the OpenVEX document for this release
curl -fsSLO https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.vex.json

# Scan the SBOM and filter out vulnerabilities addressed in the VEX document
grype --distro <os_name>:<os_version> --vex=percona-server-mongodb-{{ release }}.vex.json sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json

docs/sbom.md:150

• The page mixes two different filenames for the same OpenVEX document: the URL is shown as ...{{ release }}.openvex.json, but the download/Grype examples below use ...{{ release }}.vex.json. This will cause copy/paste failures. Please make the filename consistent throughout (for OpenVEX, *.openvex.json is the most explicit).

This issue also appears on line 154 of the same file.

The `VEX` file for version {{ release }} is available at:

`https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json`

[ktrushin]

Looks good except for the minor inaccuracy. Feel free to fix it the way you think would be the best. No need in another review cycle.

[ktrushin]

Actually, the example below uses SBOM path from DEB/RPM package.
I suggest changing the phrase as below:

Suggested change

	Pass the document to Grype's `--vex` flag together with any SBOM scan on this page. For example, combined with the binary tarball scan:
	Pass the document to Grype's `--vex` flag together with any SBOM scan on this page. For example, combined with scanning an RPM package's SBOM:

[rasika-chivate]

Reworded to "Pass the document to Grype's --vex flag along with any SBOM scan on this page. For example, when scanning the SBOM of an RPM package:"