이 문서에서는 SBOM 개념을 소개하고 소프트웨어 공급망의 종속 항목을 이해하는 데 도움이 되는 Artifact Analysis 기능을 간략하게 설명합니다.
Artifact Registry에 컨테이너 이미지를 저장할 때 해당 이미지의 콘텐츠를 설명하는 소프트웨어 재료명세서 (SBOM)를 만들 수 있습니다. 소프트웨어의 종속성을 알면 보안 상태를 개선할 수 있습니다. 또한 SBOM은 행정 명령 (EO) 14028과 같은 보안 규정 준수를 지원하기 위해 소프트웨어의 구성을 증명하는 데도 도움이 됩니다.
SBOM
SBOM은 소프트웨어에서 사용하는 패키지를 식별하는 애플리케이션의 기계 판독 가능 인벤토리입니다. 이러한 콘텐츠에는 공급업체의 서드 파티 소프트웨어, 내부 아티팩트, 오픈소스 라이브러리가 포함될 수 있습니다.
Artifact Analysis를 사용하면 SBOM을 생성하거나 직접 업로드할 수 있습니다.
Artifact Analysis로 SBOM을 생성하든 직접 업로드하든 Artifact Analysis는 일관된 저장 및 검색 프로세스를 제공하여 한곳에서 모든 종속 항목 정보를 조정하고 평가할 수 있도록 지원합니다.
Google Cloud외부에서 기존 SBOM을 업로드하려면 추가 형식이 지원됩니다. SBOM 업로드를 참고하세요.
SBOM 스토리지
아티팩트 분석은Google Cloud 프로젝트의 Cloud Storage에 SBOM을 저장합니다. SBOM 객체를 삭제하거나 버킷을 삭제하지 않는 한 SBOM은 Cloud Storage에 저장된 상태로 유지됩니다. 가격에 대한 자세한 내용은 Cloud Storage 가격 책정을 참고하세요.
지원되는 패키지 유형
SBOM은 아티팩트 분석 검사로 식별할 수 있는 모든 패키지 목록을 제공합니다. 패키지는 컨테이너화되어 Artifact Registry의 Docker 저장소에 저장되어야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-03(UTC)"],[[["\u003cp\u003eArtifact Analysis generates and stores Software Bill of Materials (SBOMs) for container images in Artifact Registry, aiding in understanding software dependencies and improving security.\u003c/p\u003e\n"],["\u003cp\u003eSBOMs created by Artifact Analysis are in SPDX 2.3 format, with support for uploading SBOMs in other formats, and are stored in Cloud Storage within your Google Cloud project.\u003c/p\u003e\n"],["\u003cp\u003eArtifact Analysis supports various package types including OS, Java (Maven), Go, Python, and Node.js (npm) and provides a Grafeas SBOM reference occurrence with details like Cloud Storage location, hash, and signature.\u003c/p\u003e\n"],["\u003cp\u003eIn addition to SBOMs, Artifact Analysis generates a Grafeas package occurrence for each installed package, including version, type, and license information, but only for images stored in Artifact Registry.\u003c/p\u003e\n"],["\u003cp\u003eThe platform will only work for images stored within Artifact Registry, and not the deprecated Container Registry, so transitioning from Container Registry to Artifact Registry is necessary to utilize these features.\u003c/p\u003e\n"]]],[],null,["# SBOM overview\n\nThis document introduces SBOM concepts and outlines the Artifact Analysis\nfeatures available to help you understand the dependencies in your software\nsupply chain.\n\nWhen you store a container image in Artifact Registry, you can create a software bill\nof materials (SBOM) describing the contents of that image. Knowing your\nsoftware's dependencies can help you improve your security posture. An SBOM can\nalso help you attest to the composition of your software in support of\ncompliance with security regulations such as\n[Executive Order (EO) 14028](https://www.cisa.gov/topics/cybersecurity-best-practices/executive-order-improving-nations-cybersecurity).\n\nSBOMs\n-----\n\nAn SBOM is a machine-readable inventory of an application, identifying the\npackages your software relies on. The contents can include third-party software\nfrom vendors, internal artifacts, and open source libraries.\n\nArtifact Analysis lets you generate SBOMs or upload your own.\n\nWhether you generate your SBOM with Artifact Analysis or upload your own,\nArtifact Analysis provides consistent storage and retrieval processes to\nhelp you coordinate and assess all of your dependency information in one place.\n\nSBOM format\n-----------\n\nArtifact Analysis produces SBOMs in the\n[Software Package Data Exchange (SPDX) 2.3](https://spdx.github.io/spdx-spec/v2.3/) format.\n\nIf you want to upload an existing SBOM from outside Google Cloud, additional\nformats are supported. See [Upload\nSBOMs](/artifact-analysis/docs/upload-sbom#formats).\n\nSBOM storage\n------------\n\nArtifact Analysis stores your SBOMs in Cloud Storage in your\nGoogle Cloud project. SBOMs remain stored in Cloud Storage unless you\n[delete the SBOM objects](/storage/docs/deleting-objects) or\n[delete the bucket](/storage/docs/deleting-buckets). For information on pricing,\nsee [Cloud Storage Pricing](https://cloud.google.com/storage/pricing).\n\nSupported package types\n-----------------------\n\nThe SBOM provides a list of all the packages that can be identified by\nArtifact Analysis scanning. Packages must be containerized\nand stored in a Docker repository in Artifact Registry.\n\nFor more information on supported package types, see\n[Container scanning overview](/artifact-analysis/docs/container-scanning-overview).\n\nSBOM reference occurrence\n-------------------------\n\nIn addition to the container-specific SBOM, Artifact Analysis generates a\nGrafeas SBOM [reference occurrence](https://github.com/grafeas/grafeas/blob/master/proto/v1/sbom.proto#L40) which includes\nthe following information:\n\n- The Cloud Storage location of the SBOM\n- A hash of the SBOM\n- A signature over the `SbomReferenceIntotoPayload`\n\nYou can use the signature to verify that the SBOM was generated by\nArtifact Analysis.\n\nThe signing uses the [DSSE signature protocol](https://github.com/secure-systems-lab/dsse), with the\npayload type `application/vnd.in-toto+json`.The payload is the jsonified value\nof the `SbomReferenceIntotoPayload`.\n\nPackage occurrence\n------------------\n\nTo provide more dependency information, Artifact Analysis also generates a\nGrafeas [package occurrence](https://github.com/grafeas/grafeas/blob/master/proto/v1/package.proto#L122) for each installed\npackage. Package occurrences include the following information:\n\n- Package version\n- Package type\n- License information for installed packages\n\nLimitations\n-----------\n\n- Installed package tracking is only supported for container images that are pushed to Artifact Registry and assessed by the Container Scanning API. By extension, the gcloud CLI lookup based on installed packages only works with images stored in Artifact Registry, because installed packages are only tracked on those images.\n\nWhat's next\n-----------\n\n- [Generate and store SBOMs](/artifact-analysis/docs/generate-store-sboms).\n- [Upload SBOMs](/artifact-analysis/docs/upload-sbom).\n- [View SBOMs and dependencies](/artifact-analysis/docs/view-sboms-dependencies)."]]
