checkId: check.verification.sbom.validation plugin: stellaops.doctor.verification severity: fail tags: [verification, sbom, cyclonedx, spdx]

SBOM Validation

Doctor check that confirms Stella Ops can produce or attach a Software Bill of Materials (SBOM) for the artifacts it verifies. It is part of the artifact verification pipeline that release operators and DevOps engineers rely on before promoting a build.

What It Checks

Requires the verification plugin plus a test artifact. In offline mode it actually parses the verification bundle for CycloneDX or SPDX JSON and counts components (a real, air-gap-safe probe). In online mode it checks whether Scanner:SbomGeneration:Enabled or Attestor:SbomAttestation:Enabled is turned on — but the out-of-process Doctor cannot fetch and validate the SBOM for the reference; that requires the runtime Scanner service.

Per ADR-026 D7 a check may never report a fabricated Pass: when only the online configuration is present (generation/attestation enabled) the check now returns an honest Skip (“not verified”) naming the unverified capability, instead of a Pass that would imply the SBOM was fetched and validated when it was not.

ConditionResult
Offline bundle missing or contains no recognizable SBOMFail
Offline bundle contains a valid CycloneDX/SPDX SBOMPass (real probe)
SBOM generation and attestation both disabledWarn
Online, generation or attestation enabled (config present, SBOM not fetched/validated)Skip — “not verified; requires the runtime Scanner service”

To get a verifiable green here in an air-gapped environment, supply an offline bundle (Doctor__Plugins__Verification__TestArtifact__OfflineBundlePath) so the real SBOM-parse probe runs.

Why It Matters

SBOMs are the input for downstream vulnerability analysis, policy decisions, and customer evidence exports. If SBOM generation is off, release evidence is incomplete.

Common Causes

How to Fix

Docker Compose

services:
  doctor-web:
    environment:
      Scanner__SbomGeneration__Enabled: "true"
      Attestor__SbomAttestation__Enabled: "true"

For offline mode:

stella verification bundle export --include-sbom --output /var/lib/stella/verification/offline-bundle.json

Bare Metal / systemd

Enable SBOM generation in the scanner and keep artifact attachments immutable once published.

Kubernetes / Helm

Mount the same scanner and attestor config into Doctor that the production verification pipeline uses.

Verification

stella doctor run --check check.verification.sbom.validation