Skip to content
Percona Software for MongoDB Documentation
Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Software Bill of Materials

A Software Bill of Materials (SBOM) is a machine-readable inventory of the components and dependencies included in a software release. It helps you understand what is included in a build and assess potential security or compliance risks.

Starting with version 8.3, every Percona Server for MongoDB (PSMDB) release includes a CycloneDX SBOM in JSON format.

Why it matters

An SBOM helps you:

  • Identify the components and dependencies included in a PSMDB release.
  • Assess known vulnerabilities using SBOM-compatible security scanners.
  • Support security reviews, compliance processes, and software supply chain requirements.
  • Verify the contents of deployed software artifacts.

Where to find the SBOM

Distribution method SBOM location
Binary tarball doc/sbom.cdx.json
RPM package /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json
DEB package /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json
Docker image Embedded in the image and available as an attached OCI artifact. See Docker images.

Verifying and scanning the SBOM

The examples below use Grype .

Note

Trivy cannot currently scan the SBOMs included with Percona Server for MongoDB DEB and RPM packages or binary tarballs. Most dependencies in these SBOMs are identified using the GitHub package type, which Trivy does not fully support in this context.

Trivy can, however, scan the SBOMs attached to Percona Server for MongoDB Docker images as OCI artifacts.

Binary tarball

# Confirm the SBOM is bundled
tar tzf percona-server-mongodb-8.3.7-1-x86_64.<os_codename>.tar.gz \
    | grep doc/sbom.cdx.json

# Extract and scan
tar xzf percona-server-mongodb-8.3.7-1-x86_64.<os_codename>.tar.gz \
    -C /tmp percona-server-mongodb-8.3.7-1-x86_64.<os_codename>/doc/sbom.cdx.json
grype sbom:/tmp/percona-server-mongodb-8.3.7-1-x86_64.<os_codename>/doc/sbom.cdx.json

RPM package

# Confirm the package installs the SBOM
rpm -ql percona-server-mongodb-server | grep sbom.cdx.json

# Scan it (replace `rhel:9.8` with your `<os_name>:<os_version>`)
grype --distro rhel:9.8 sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json

DEB package

# Confirm the package installs the SBOM
dpkg -L percona-server-mongodb-server | grep sbom.cdx.json

# Scan it (replace `ubuntu:24.04` with your `<os_name>:<os_version>`)
grype --distro ubuntu:24.04 sbom:/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json

Docker images

Each PSMDB Docker image (Docker Hub docker.io/percona/percona-server-mongodb-server, PerconaLab docker.io/perconalab/percona-server-mongodb-server) ships with two CycloneDX SBOMs that describe overlapping scopes:

SBOM Scope CycloneDX version How to access
Embedded PSMDB packages only 1.5 Inside the image filesystem
OCI-attached Full image — PSMDB and UBI9 base OS packages 1.6 Registry-side, via the OCI Referrers API

trivy image --sbom-sources oci fetches the attached SBOM via the OCI Referrers API and scans it, without pulling the image:

trivy image --severity HIGH,CRITICAL --sbom-sources oci \
    docker.io/percona/percona-server-mongodb:8.3.7-1-amd64

Scan the embedded SBOM

Scan the embedded SBOM from inside the container image: 8.3.7-1-amd64:

docker run --rm -it --entrypoint cat \
    docker.io/percona/percona-server-mongodb:8.3.7-1-amd64 \
    /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json \
    | grype --from sbom

Advanced: Inspect OCI-attached SBOMs with ORAS

You can use the ORAS CLI to discover and download OCI-attached SBOMs.

Follow these steps:

  1. Use the per-architecture tag to resolve directly to the image manifest:

    oras discover --format tree \
    docker.io/percona/percona-server-mongodb:8.3.7-1-amd64
    Output 
    docker.io/percona/percona-server-mongodb@sha256:<image_manifest_digest>
└── application/vnd.cyclonedx+json
    └── sha256:<sbom_artifact_digest>
        └── [annotations]
            └── org.opencontainers.image.created: "2026-07-28T14:24:59Z"

    The <image_manifest_digest> identifies the container image. The <sbom_artifact_digest> identifies the CycloneDX SBOM artifact attached to that image.

  2. Copy the SBOM artifact digest from the output and use it to download the SBOM to the current directory. Replace <sbom_artifact_digest> with the value displayed after sha256::

    oras pull docker.io/percona/percona-server-mongodb@sha256:<sbom_artifact_digest>

  3. Confirm that the SBOM file was downloaded:

    ls
    Output 
    percona-server-mongodb-8.3.7-1-amd64.cdx.json

Filtering vulnerabilities with OpenVEX

OpenVEX is an open, minimal format for Vulnerability Exploitability eXchange (VEX) statements. A VEX document records whether a known vulnerability (CVE) in a component actually affects a given product — for example, the vulnerable code path is unreachable, the issue is already fixed, or it’s still under investigation. Scanners that support VEX use these statements to suppress vulnerabilities that don’t actually apply, cutting down on noise from CVEs in bundled dependencies that PSMDB isn’t actually exposed to.

Percona publishes an OpenVEX document for every PSMDB release, plus one combined document covering all releases and CVE statuses:

OpenVEX document URL
Per-release https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-<VERSION>.openvex.json
All releases https://percona.github.io/percona-server-mongodb/vex/openvex.json

For example, the document for version 8.3.7-1 is available at:

https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-8.3.7-1.openvex.json

Pass the document to Grype’s --vex flag together with any SBOM scan on this page. For example, combined with the binary tarball scan:

# Download the OpenVEX document for this release
curl -sLO https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-8.3.7-1.openvex.json

# Scan the SBOM and filter out vulnerabilities addressed in the VEX document
grype sbom:/tmp/percona-server-mongodb-8.3.7-1-x86_64.<os_codename>/doc/sbom.cdx.json \
    --vex percona-server-mongodb-8.3.7-1.openvex.json

Vulnerabilities that Percona has marked as not_affected or fixed in the VEX document are excluded from the scan results.