BYOS SBOM ingestion

Overview

• Accepts external SBOMs and runs them through validation, normalization, and analysis triggers.
• Stores the SBOM artifact in the scanner object store and records provenance metadata.
• Persists hot-lookup projection rows in scanner.artifact_boms (default scanner schema contract).
• Emits a deterministic analysis job id tied to the upload metadata.
• Persists upload metadata under the validated tenant. The same content-derived SBOM ID may exist independently in multiple tenants; status reads never fall through to another tenant’s record.

API

• POST /api/v1/sbom/upload
• GET /api/v1/sbom/uploads/{sbomId}

Example request:

{
  "artifactRef": "example.com/app:1.0",
  "sbomBase64": "<base64>",
  "format": "cyclonedx",
  "source": { "tool": "syft", "version": "1.0.0" }
}

Supported formats

• CycloneDX JSON 1.4-1.6 (bomFormat, specVersion)
• SPDX JSON 2.3 (spdxVersion)
• SPDX JSON 3.0 (structural checks only; schema validation pending)

Validation is structural for the accepted JSON contracts; it is not full offline validation against the published CycloneDX or SPDX JSON schemas.

CLI

stella sbom upload --file sbom.json --artifact example.com/app:1.0

Troubleshooting

• Missing format: ensure bomFormat (CycloneDX) or spdxVersion (SPDX).
• Unsupported versions: CycloneDX must be 1.4-1.6; SPDX must be 2.3 or 3.0.
• Empty component lists are accepted but reduce quality scores.