Software Bill of Materials
FeatherBit publishes an SBOM (software bill of materials) in CycloneDX JSON format — a machine-readable inventory of every third-party package the software contains, usable for license review, vulnerability matching (grype, trivy, and most SCA tools consume CycloneDX directly), and supply-chain compliance.
There is one SBOM per component, so each file states exactly which part of the product the listed material is used in:
| SBOM | Component | What it covers | Shipped in the product? |
|---|---|---|---|
featherbit-gateway.cdx.json | Gateway binary | Rust crates compiled into the featherbit binary (from Cargo.lock) | Yes |
featherbit-ui.cdx.json | Web UI | npm packages bundled into the embedded node-graph editor (from ui/package-lock.json) | Yes in the default build; absent from the -headless variant |
featherbit-website.cdx.json | Documentation site | npm packages used to build this docs site (from website/package-lock.json) | No — build tooling for the website only |
featherbit-image.cdx.json | Docker image | Everything inside the published container image: the gateway binary's crate inventory plus CA certificates | Yes — this is the deployed artifact |
All SBOMs are stamped with the gateway version they were generated from (metadata.component in each file names the component and version).
Downloads (latest main)
Regenerated on every docs deploy, so these always match the current main branch:
Per-release SBOMs
Every vX.Y.Z GitHub release carries all four SBOMs as assets — including featherbit-image.cdx.json, generated by scanning the exact image pushed to Docker Hub for that release. Use these when you need the inventory of a specific deployed version rather than latest main.
Auditable binaries
The released binary is built with cargo auditable, which embeds the full crate dependency list in the binary itself. Two practical consequences:
- The Docker image SBOM is meaningful even though the runtime image is
FROM scratch— syft reads the crate inventory straight out of the binary. - You can audit a deployed gateway without any of these files: point syft, grype, or trivy at the binary or the pulled image and they will recover the same inventory.
# Inventory a pulled image directly
syft featherbitplatform/featherbit:latest
# Check a deployed binary for known-vulnerable crates
grype /path/to/gateway