From 6061e16186b5f42c4f9159b8b3eb2195c272e653 Mon Sep 17 00:00:00 2001 From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com> Date: Fri, 31 Jul 2026 19:00:31 +0530 Subject: [PATCH 1/5] PSMDB-2150 SBOMs --- docs/sbom.md | 139 ++++++++++++++++++++++++++++++++++++++++++++++++ mkdocs-base.yml | 1 + 2 files changed, 140 insertions(+) create mode 100644 docs/sbom.md diff --git a/docs/sbom.md b/docs/sbom.md new file mode 100644 index 000000000..d3c680f41 --- /dev/null +++ b/docs/sbom.md @@ -0,0 +1,139 @@ +# Software Bill of Materials + +A Software Bill of Materials (SBOM) is a machine-readable inventory of the components and dependencies included in a software release. It helps you understand what is included in a build and assess potential security or compliance risks. + +Starting with version 7.0.39-21, every Percona Server for MongoDB (PSMDB) release includes a [CycloneDX :octicons-link-external-16:](https://cyclonedx.org/specification/overview/){:target="_blank"} SBOM in JSON format. + +## Why it matters + +An SBOM helps you: + +- Identify the components and dependencies included in a PSMDB release. +- Assess known vulnerabilities using SBOM-compatible security scanners. +- Support security reviews, compliance processes, and software supply chain requirements. +- Verify the contents of deployed software artifacts. + +## Where to find the SBOM + +| Distribution method | SBOM location | +|---|---| +| Binary tarball | `doc/sbom.cdx.json` | +| RPM package | `/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json` | +| DEB package | `/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json` | +| Docker image | Embedded in the image and available as an attached OCI artifact. See [Docker images](#docker-images). | + + +## Verifying and scanning the SBOM + +The examples below use [Grype :octicons-link-external-16:](https://github.com/anchore/grype){:target="_blank"}. + +!!! note + [Trivy :octicons-link-external-16:](https://trivy.dev/){:target="_blank"} cannot currently scan the SBOMs included with Percona Server for MongoDB DEB and RPM packages or binary tarballs. Most dependencies in these SBOMs are identified using the GitHub package type, which Trivy does not fully support in this context. + + Trivy can, however, scan the SBOMs attached to Percona Server for MongoDB Docker images as OCI artifacts. + +### Binary tarball + +```bash +# Confirm the SBOM is bundled +tar tzf percona-server-mongodb-{{ release }}-x86_64..tar.gz \ + | grep doc/sbom.cdx.json + +# Extract and scan +tar xzf percona-server-mongodb-{{ release }}-x86_64..tar.gz \ + -C /tmp percona-server-mongodb-{{ release }}-x86_64./doc/sbom.cdx.json +grype sbom:/tmp/percona-server-mongodb-{{ release }}-x86_64./doc/sbom.cdx.json +``` + +### RPM package + +```bash +# Confirm the package installs the SBOM +rpm -ql percona-server-mongodb-server | grep sbom.cdx.json + +# Scan it (replace `rhel:9.8` with your `:`) +grype --distro rhel:9.8 sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json +``` + +### DEB package + +```bash +# Confirm the package installs the SBOM +dpkg -L percona-server-mongodb-server | grep sbom.cdx.json + +# Scan it (replace `ubuntu:24.04` with your `:`) +grype --distro ubuntu:24.04 sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json +``` + +### Docker images + +Each PSMDB Docker image (Docker Hub `docker.io/percona/percona-server-mongodb-server`, PerconaLab `docker.io/perconalab/percona-server-mongodb-server`) ships with **two** CycloneDX SBOMs that describe overlapping scopes: + +| SBOM | Scope | CycloneDX version | How to access | +|---|---|---|---| +| **Embedded** | PSMDB packages only | 1.5 | Inside the image filesystem | +| **OCI-attached** | Full image — PSMDB and UBI9 base OS packages | 1.6 | Registry-side, via the OCI Referrers API | + +#### Scan via OCI Referrers API (recommended) + +`trivy image --sbom-sources oci` fetches the attached SBOM via the OCI Referrers API and scans it, without pulling the image: + +```bash +trivy image --severity HIGH,CRITICAL --sbom-sources oci \ + docker.io/percona/percona-server-mongodb:{{ release }}-amd64 +``` + +#### Scan the embedded SBOM + +Scan the embedded SBOM from inside the container image: `{{ release }}-amd64`: + +```bash +docker run --rm -it --entrypoint cat \ + docker.io/percona/percona-server-mongodb:{{ release }}-amd64 \ + /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json \ + | grype --from sbom +``` + +#### Advanced: Inspect OCI-attached SBOMs with ORAS + +You can use the [ORAS CLI :octicons-link-external-16:](https://oras.land/){:target="_blank"} to discover and download OCI-attached SBOMs. + +Follow these steps: +{.power-number} + +1. Use the per-architecture tag to resolve directly to the image manifest: + + ```bash + oras discover --format tree \ + docker.io/percona/percona-server-mongodb:{{ release }}-amd64 + ``` + + ??? example "Output" + + ```text + docker.io/percona/percona-server-mongodb@sha256: + └── application/vnd.cyclonedx+json + └── sha256: + └── [annotations] + └── org.opencontainers.image.created: "2026-07-28T14:24:59Z" + ``` + + The `` identifies the container image. The `` identifies the CycloneDX SBOM artifact attached to that image. + +2. Copy the SBOM artifact digest from the output and use it to download the SBOM to the current directory. Replace `` with the value displayed after `sha256:`: + + ```bash + oras pull docker.io/percona/percona-server-mongodb@sha256: + ``` + +3. Confirm that the SBOM file was downloaded: + + ```bash + ls + ``` + + ??? example "Output" + + ```text + percona-server-mongodb-{{ release }}-amd64.cdx.json + ``` \ No newline at end of file diff --git a/mkdocs-base.yml b/mkdocs-base.yml index 9e69ab387..1fc7b1a5f 100644 --- a/mkdocs-base.yml +++ b/mkdocs-base.yml @@ -262,6 +262,7 @@ nav: - release_notes/7.0.2-1.md - faq.md - Reference: + - Software Bill of Materials (SBOM): sbom.md - glossary.md - telemetry.md - copyright.md From 37c317142e4da3af5790dcaea1e2b38d0719518d Mon Sep 17 00:00:00 2001 From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com> Date: Fri, 31 Jul 2026 19:07:29 +0530 Subject: [PATCH 2/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sbom.md b/docs/sbom.md index d3c680f41..fff72ad70 100644 --- a/docs/sbom.md +++ b/docs/sbom.md @@ -67,7 +67,7 @@ grype --distro ubuntu:24.04 sbom:/usr/share/doc/percona-server-mongodb-server/sb ### Docker images -Each PSMDB Docker image (Docker Hub `docker.io/percona/percona-server-mongodb-server`, PerconaLab `docker.io/perconalab/percona-server-mongodb-server`) ships with **two** CycloneDX SBOMs that describe overlapping scopes: +Each PSMDB Docker image (Docker Hub `docker.io/percona/percona-server-mongodb`, PerconaLab `docker.io/perconalab/percona-server-mongodb`) ships with **two** CycloneDX SBOMs that describe overlapping scopes: | SBOM | Scope | CycloneDX version | How to access | |---|---|---|---| From 40fc3fc2b3c93168c33f4c6368430b1f96c0bcb5 Mon Sep 17 00:00:00 2001 From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com> Date: Tue, 4 Aug 2026 19:16:32 +0530 Subject: [PATCH 3/5] Update sbom.md --- docs/sbom.md | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/docs/sbom.md b/docs/sbom.md index fff72ad70..4ce875af2 100644 --- a/docs/sbom.md +++ b/docs/sbom.md @@ -136,4 +136,32 @@ Follow these steps: ```text percona-server-mongodb-{{ release }}-amd64.cdx.json - ``` \ No newline at end of file + ``` + +## Filtering vulnerabilities with OpenVEX + +[OpenVEX :octicons-link-external-16:](https://github.com/openvex/spec){:target="_blank"} is an open, minimal format for Vulnerability Exploitability eXchange (VEX) statements. A VEX document records whether a known vulnerability (CVE) in a component actually affects a given product — for example, the vulnerable code path is unreachable, the issue is already fixed, or it's still under investigation. Scanners that support VEX use these statements to suppress vulnerabilities that don't actually apply, cutting down on noise from CVEs in bundled dependencies that PSMDB isn't actually exposed to. + +Percona publishes an OpenVEX document for every PSMDB release, plus one combined document covering all releases and CVE statuses: + +| OpenVEX document | URL | +|---|---| +| Per-release | `https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json` | +| All releases | | + +For example, the document for version {{ release }} is available at: + +`https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json` + +Pass the document to Grype's `--vex` flag together with any SBOM scan on this page. For example, combined with the binary tarball scan: + +```bash +# Download the OpenVEX document for this release +curl -fsSLO https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.vex.json + +# Scan the SBOM and filter out vulnerabilities addressed in the VEX document +grype --distro : --vex=percona-server-mongodb-{{ release }}.vex.json sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json +``` + +!!! note + The example above reports only [CVE-2026-6231 :octicons-link-external-16:](https://nvd.nist.gov/vuln/detail/cve-2026-6231){:target="_blank"}. This vulnerability affects Percona Server for MongoDB deployments that use [Queryable Encryption :octicons-link-external-16:](https://www.mongodb.com/docs/manual/core/queryable-encryption/about-qe-csfle/){:target="_blank"}. The vulnerability existed before version {{ release }}, but the SBOM now makes it visible. Percona plans to fix it in a future release. \ No newline at end of file From 902833b389a88f89d600fb18841b1c1a6c7ca555 Mon Sep 17 00:00:00 2001 From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com> Date: Tue, 4 Aug 2026 21:38:09 +0530 Subject: [PATCH 4/5] implemented feedback --- docs/sbom.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/sbom.md b/docs/sbom.md index 4ce875af2..a6d732033 100644 --- a/docs/sbom.md +++ b/docs/sbom.md @@ -142,14 +142,9 @@ Follow these steps: [OpenVEX :octicons-link-external-16:](https://github.com/openvex/spec){:target="_blank"} is an open, minimal format for Vulnerability Exploitability eXchange (VEX) statements. A VEX document records whether a known vulnerability (CVE) in a component actually affects a given product — for example, the vulnerable code path is unreachable, the issue is already fixed, or it's still under investigation. Scanners that support VEX use these statements to suppress vulnerabilities that don't actually apply, cutting down on noise from CVEs in bundled dependencies that PSMDB isn't actually exposed to. -Percona publishes an OpenVEX document for every PSMDB release, plus one combined document covering all releases and CVE statuses: +Percona publishes an OpenVEX document for every PSMDB release. -| OpenVEX document | URL | -|---|---| -| Per-release | `https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json` | -| All releases | | - -For example, the document for version {{ release }} is available at: +The `VEX` file for version {{ release }} is available at: `https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json` From de1c6dcdc973ccb0c07ef695c1655ee6e74acd5d Mon Sep 17 00:00:00 2001 From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com> Date: Tue, 4 Aug 2026 22:22:35 +0530 Subject: [PATCH 5/5] Update sbom.md --- docs/sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sbom.md b/docs/sbom.md index a6d732033..cb74919a1 100644 --- a/docs/sbom.md +++ b/docs/sbom.md @@ -148,7 +148,7 @@ The `VEX` file for version {{ release }} is available at: `https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.openvex.json` -Pass the document to Grype's `--vex` flag together with any SBOM scan on this page. For example, combined with the binary tarball scan: +Pass the document to Grype's `--vex` flag along with any SBOM scan on this page. For example, when scanning the SBOM of an RPM package: ```bash # Download the OpenVEX document for this release