checkId: check.verification.sbom.validation plugin: stellaops.doctor.verification severity: fail tags: [verification, sbom, cyclonedx, spdx]
SBOM Validation
Doctor check that confirms Stella Ops can produce or attach a Software Bill of Materials (SBOM) for the artifacts it verifies. It is part of the artifact verification pipeline that release operators and DevOps engineers rely on before promoting a build.
What It Checks
Requires the verification plugin plus a test artifact. In offline mode it actually parses the verification bundle for CycloneDX or SPDX JSON and counts components (a real, air-gap-safe probe). In online mode it checks whether Scanner:SbomGeneration:Enabled or Attestor:SbomAttestation:Enabled is turned on — but the out-of-process Doctor cannot fetch and validate the SBOM for the reference; that requires the runtime Scanner service.
Per ADR-026 D7 a check may never report a fabricated Pass: when only the online configuration is present (generation/attestation enabled) the check now returns an honest Skip (“not verified”) naming the unverified capability, instead of a Pass that would imply the SBOM was fetched and validated when it was not.
| Condition | Result |
|---|---|
| Offline bundle missing or contains no recognizable SBOM | Fail |
| Offline bundle contains a valid CycloneDX/SPDX SBOM | Pass (real probe) |
| SBOM generation and attestation both disabled | Warn |
| Online, generation or attestation enabled (config present, SBOM not fetched/validated) | Skip — “not verified; requires the runtime Scanner service” |
To get a verifiable green here in an air-gapped environment, supply an offline bundle (Doctor__Plugins__Verification__TestArtifact__OfflineBundlePath) so the real SBOM-parse probe runs.
Why It Matters
SBOMs are the input for downstream vulnerability analysis, policy decisions, and customer evidence exports. If SBOM generation is off, release evidence is incomplete.
Common Causes
- The build pipeline is not producing SBOMs
- SBOM attestation is disabled even though verification expects it
- Offline bundles were exported without
--include-sbom
How to Fix
Docker Compose
services:
doctor-web:
environment:
Scanner__SbomGeneration__Enabled: "true"
Attestor__SbomAttestation__Enabled: "true"
For offline mode:
stella verification bundle export --include-sbom --output /var/lib/stella/verification/offline-bundle.json
Bare Metal / systemd
Enable SBOM generation in the scanner and keep artifact attachments immutable once published.
Kubernetes / Helm
Mount the same scanner and attestor config into Doctor that the production verification pipeline uses.
Verification
stella doctor run --check check.verification.sbom.validation
Related Checks
check.verification.artifact.pull- the artifact must be reachable before attached SBOMs can be validatedcheck.verification.policy.engine- policy rules commonly consume SBOM-derived vulnerability data
