nordisk/holger

SBOM hosting — for idiots

Class: guide (beginner) · Function: sbom. The gentlest possible version. The full how-to is sbom-hosting-guide.md; the why is sbom-hosting-design.md.

What's an SBOM?

An SBOM (Software Bill of Materials) is a list of everything inside a package — which libraries, which versions, which licenses, and any known vulnerabilities. It's the "ingredients label" for software. Auditors and airgap operators want it.

What changed?

Before: holger could make an SBOM but had nowhere to keep it. It fell on the floor.

Now: holger hosts the SBOM right next to the package it describes. You "pin" (attach) an SBOM to an artifact — say serde version 1.0.0 in the rust-dev repo — and anyone can pull that exact SBOM back later.

The two things you do

1. Attach — hand holger an SBOM file and say which artifact it belongs to.
2. Fetch — ask holger for the SBOM of that artifact; you get back the exact same bytes you attached.

# 1. Attach
holger-server sbom attach --config holger.ron \
  --repo rust-dev --name serde --version 1.0.0 --file serde.cdx.json

# 2. Fetch (later, maybe from another tool)
holger-server sbom fetch --config holger.ron \
  --repo rust-dev --name serde --version 1.0.0 --out got-it.cdx.json

Or over the web (read-only):

curl 'https://holger.example/-/sbom?repo=rust-dev&name=serde&version=1.0.0'

Things that are handy to know

• Same bytes back. What you attach is what you get — byte-for-byte. So you can hash or sign the SBOM and trust it later.
• Re-attach to update. New scan? Attach again; the new one replaces the old.
• Ask for one that isn't there? You get a clean "not found" (a 404 over HTTP), not a crash.
• Attaching is a write. If your holger has roles turned on, you need a writer/admin token to attach; anyone can read.
• A groupId? Java/Maven packages have a namespace — add --namespace org.example. Cargo/PyPI don't need one.

That's the whole idea: pin an ingredients label to a package, pull it back whenever you want.