Contents

SBOM and CBOM

Every gitta release comes with a software bill of materials (SBOM) and a cryptography bill of materials (CBOM). Both editions have them: the open-source CLI and gitta Enterprise.

What is published

File	Contents	Edition
`gitta-VERSION.cdx.json`, `gitta-fs-VERSION.cdx.json`, `gitta-sandbox-VERSION.cdx.json`	All Rust crates in each CLI binary, with versions and package URLs, from `Cargo.lock`	Open source
`gitta-VERSION.cbom.cdx.json`	The cryptography of the CLI	Open source
`gitta-server-VERSION.cdx.json`	All Rust crates in the team server and the licence tool	Enterprise
`gitta-server-image-VERSION.cdx.json`	The server container image: operating system packages, files, and the crates of the server binary	Enterprise
`gitta-enterprise-VERSION.cbom.cdx.json`	The cryptography of the team server, the licence tool and the CLI code in the server	Enterprise
`sbom.sha256`	SHA-256 checksums of the files above	Both

Each SBOM also comes as SPDX 2.3 JSON, with .spdx.json in place of .cdx.json.

Formats

SBOM: CycloneDX 1.6 JSON and SPDX 2.3 JSON.
CBOM: CycloneDX 1.6 JSON with cryptographic-asset components.

The CBOM lists each algorithm, protocol, certificate and key that gitta uses. For each one it gives the component and the purpose, the parameters, and the library and version that provide it. For TLS it gives the protocol versions, cipher suites and key exchange groups that the server allows.

The CLI calls the system curl for HTTPS. So the TLS settings of the CLI come from your operating system, and the CBOM says so. You can give the CLI your own certificate authority with GITTA_SERVER_CA.

We make the CBOM from a crypto inventory in the source code, and read the library versions from Cargo.lock. A build fails when a crypto library is added, removed or updated and the inventory is not.

Where to get them

Open source

The files are attached to each release on GitHub releases.

Terminal

$ curl -fsSLO https://github.com/gitta-io/gitta/releases/download/v0.1.0/gitta-0.1.0.cbom.cdx.json

Enterprise

Use your registry access for the server image. All files for a version are in one registry artifact:

Terminal

$ oras pull europe-north1-docker.pkg.dev/gitta-io-prod/enterprise/sbom:0.1.0

The image SBOM and the CBOM are also attached to the image itself, as OCI referrers. To list them:

Terminal

$ oras discover europe-north1-docker.pkg.dev/gitta-io-prod/enterprise/gitta-server:0.1.0

How to verify

Check the checksums.
Terminal
```
$ sha256sum -c sbom.sha256
```

Check the files against the CycloneDX schema.

Terminal

$ cyclonedx validate --input-file gitta-enterprise-0.1.0.cbom.cdx.json --input-version v1_6

For the image, use the referrers of the image digest that you run. Then the SBOM is for that exact image.

The files are not signed yet. The checksums and the registry access control protect them. Ask [email protected] if your review needs signed files.

For the control mapping, see Compliance.

To check a build that you downloaded, see Install.