checkId: check.scanner.sbom plugin: stellaops.doctor.scanner severity: warn tags: [scanner, sbom, cyclonedx, spdx, compliance]

SBOM Generation Health

This Doctor check watches the Scanner’s SBOM generation pipeline – the stage that produces the Software Bill of Materials every downstream security stage depends on. It is aimed at operators and on-call engineers who need to catch failing or invalid SBOM output before it silently degrades vulnerability scanning, reachability analysis, and the release gates built on top of them.

What It Checks

Queries the Scanner service at /api/v1/sbom/stats and evaluates SBOM generation health:

Evidence collected: total_generated, successful_generations, failed_generations, success_rate, format_cyclonedx, format_spdx, validation_failures.

The check requires Scanner:Url or Services:Scanner:Url to be configured.

Why It Matters

SBOMs are the foundation of the entire Stella Ops security pipeline. Without valid SBOMs, vulnerability scanning produces incomplete results, reachability analysis cannot run, and release gates that require an SBOM attestation will block promotions. Compliance frameworks (e.g., EO 14028, EU CRA) mandate accurate SBOMs for every shipped artifact.

Common Causes

How to Fix

Docker Compose

# View recent SBOM generation failures
docker compose -f docker-compose.stella-ops.yml logs scanner | grep -i "sbom.*fail"

# Restart the scanner to clear any cached bad state
docker compose -f docker-compose.stella-ops.yml restart scanner

If out-of-memory failures are suspected, raise the scanner’s memory limit and tighten SBOM settings in docker-compose.stella-ops.yml:

services:
  scanner:
    deploy:
      resources:
        limits:
          memory: 4G
    environment:
      Scanner__Sbom__ValidationMode: "Strict"
      Scanner__Sbom__MaxArtifactSizeMb: "500"

Bare Metal / systemd

# Check scanner logs for SBOM errors
sudo journalctl -u stellaops-scanner --since "1 hour ago" | grep -i sbom

# Retry failed SBOMs
stella scanner sbom retry --failed

Edit /etc/stellaops/scanner/appsettings.json:

{
  "Sbom": {
    "ValidationMode": "Strict",
    "MaxArtifactSizeMb": 500
  }
}

Kubernetes / Helm

# Check for OOMKilled scanner pods
kubectl get pods -l app=stellaops-scanner -o wide
kubectl describe pod <scanner-pod> | grep -A 5 "Last State"

# View SBOM-related logs
kubectl logs -l app=stellaops-scanner --tail=200 | grep -i sbom

Set in Helm values.yaml:

scanner:
  resources:
    limits:
      memory: 4Gi
  sbom:
    validationMode: Strict
    maxArtifactSizeMb: 500

Verification

stella doctor run --check check.scanner.sbom