Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara mengupload file software bill of materials (SBOM) ke Cloud Storage untuk membantu melacak dan membuktikan komponen image container yang Anda simpan di Artifact Registry.
Untuk mengetahui informasi tentang harga Cloud Storage, lihat
Harga.
Memiliki repositori Docker di Artifact Registry dengan image container yang dijelaskan oleh SBOM Anda. Jika Anda belum terbiasa dengan Artifact Registry, lihat
Panduan memulai Docker.
Untuk mendapatkan izin yang
diperlukan untuk membuat dan mengelola bucket Cloud Storage dan file SBOM,
minta administrator Anda untuk memberi Anda
peran IAM berikut pada project:
Jika Anda menggunakan bucket Cloud Storage default, untuk mengelola bucket penyimpanan:
Admin Penyimpanan(roles/storage.admin)
Jika Anda menentukan bucket Cloud Storage, untuk mengelola bucket penyimpanan:
Storage Object Admin(roles/storage.objectAdmin)
Gunakan perintah berikut untuk mengupload SBOM Anda:
gcloudartifactssbomload/
--sourceSOURCE/
--uriURI
Dengan:
SOURCE: jalur ke file SBOM yang akan diupload.
URI: URI untuk image Docker yang dijelaskan oleh file SBOM.
Gambar dapat berupa format tag, atau format ringkasan. Gambar yang diberikan dalam format tag akan di-resolve menjadi format ringkasan.
Flag opsional
--destination: menentukan bucket Cloud Storage yang akan digunakan, bukan bucket default.
--kms-key-version: menyediakan versi kunci untuk menandatangani payload kemunculan
referensi SBOM. Anda dapat menggunakan kunci ini untuk memverifikasi asal SBOM.
Misalnya, perintah berikut mengupload file JSON my-sbom.bom.json yang
dibuat dari gambar yang diberi tag
us-east1-docker.pkg.dev/my-image-repo/my-image, dan menandatangani kemunculan
referensi SBOM dengan versi kunci KMS yang diakhiri dengan my-key/cryptoKeyVersions/1.
Perintah berikut mengupload file JSON my-sbom.spdx.json yang terkait dengan ringkasan gambar my-local-image@sha256:abcxyz, dan menyimpan file di bucket Cloud Storage gs://my-sbom-bucket.
Artifact Analysis mengupload SBOM Anda ke Cloud Storage dan membuat
kemunculan referensi SBOM.
Anda dapat melihat SBOM menggunakan konsol Google Cloud atau gcloud CLI.
Jika ingin menemukan bucket Cloud Storage yang berisi SBOM Anda, Anda harus menelusuri SBOM menggunakan gcloud CLI.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[[["\u003cp\u003eThis page explains how to upload a Software Bill of Materials (SBOM) file to Cloud Storage for tracking and attesting to the components of container images in Artifact Registry.\u003c/p\u003e\n"],["\u003cp\u003eBefore uploading, you need a Docker repository in Artifact Registry with the relevant container image and an SBOM file in either SPDX (version 2.2 or 2.3) or CycloneDX (version 1.4 or 1.5) format.\u003c/p\u003e\n"],["\u003cp\u003eUploading an SBOM involves using the \u003ccode\u003egcloud artifacts sbom load\u003c/code\u003e command, specifying the SBOM file's source path and the URI of the associated Docker image.\u003c/p\u003e\n"],["\u003cp\u003eYou can optionally designate a specific Cloud Storage bucket for storing the SBOMs and sign the SBOM reference occurrence with a KMS key version for origin verification.\u003c/p\u003e\n"],["\u003cp\u003eAfter uploading, Artifact Analysis stores the SBOM in Cloud Storage and creates an SBOM reference occurrence that can be viewed through the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"]]],[],null,["# Upload SBOMs\n\nThis page describes how to upload a software bill of materials (SBOM) file to\nCloud Storage to help track and attest to the components of container images\nyou store in Artifact Registry.\n\nFor information on Cloud Storage pricing, see\n[Pricing](https://cloud.google.com/storage/pricing).\n\nBefore you begin\n----------------\n\n- [Sign in](https://accounts.google.com/Login) to your Google Account.\n\n If you don't already have one, [sign up for a new account](https://accounts.google.com/SignUp).\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Artifact Registry, Container Analysis APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://artifactregistry.googleapis.com, https://containeranalysis.googleapis.com,)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Artifact Registry, Container Analysis APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://artifactregistry.googleapis.com, https://containeranalysis.googleapis.com,)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. Have a Docker repository in Artifact Registry with the container image that your SBOM describes. If you are not familiar with Artifact Registry, see the [Docker quickstart](/artifact-registry/docs/docker/store-docker-container-images).\n2. Have an SBOM file ready to upload in one of the [supported formats](/artifact-analysis/docs/upload-sbom#formats).\n\n\u003cbr /\u003e\n\n### Required roles\n\n\nTo get the permissions that\nyou need to create and manage Cloud Storage buckets and SBOM files ,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- If you are using the default Cloud Storage bucket, to manage storage buckets: Storage Admin(`roles/storage.admin`)\n- If you are specifying a Cloud Storage bucket, to manage storage buckets: Storage Object Admin(`roles/storage.objectAdmin`)\n- If a note for the SBOM reference already exists: [Container Analysis Notes Attacher](/iam/docs/roles-permissions/containeranalysis#containeranalysis.notes.attacher) (`roles/containeranalysis.notes.attacher`)\n- To create a new note for SBOM reference occurrences in the current project: Container Analysis Notes Editor(`(roles/containeranalysis.notes.editor`)\n- To create an SBOM reference occurrence: Container Analysis Occurrences Editor(`roles/containeranalysis.occurrences.editor`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nSupported formats\n-----------------\n\nYour SBOM file must be a JSON file in one of the following formats:\n\n- [Software Package Data Exchange (SPDX)](https://spdx.dev/) version 2.2 or 2.3\n- [CycloneDX](https://cyclonedx.org/) version 1.4 or 1.5\n\nUpload your SBOM\n----------------\n\nUse the following command to upload your SBOM: \n\n gcloud artifacts sbom load /\n --source \u003cvar translate=\"no\"\u003eSOURCE\u003c/var\u003e /\n --uri \u003cvar translate=\"no\"\u003eURI\u003c/var\u003e\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eSOURCE\u003c/var\u003e: the path to the SBOM file to upload.\n- \u003cvar translate=\"no\"\u003eURI\u003c/var\u003e: the URI for the Docker image that the SBOM file describes. Images can be in either tag format, or digest format. Images provided in tag format will be resolved into digest format.\n\n### Optional flags\n\n- `--destination`: specifies a Cloud Storage bucket to use instead of the default one.\n- `--kms-key-version`: provides a key version to sign the SBOM reference occurrence payload. You can use this key to verify the origin of the SBOM.\n\nFor example, the following command uploads a JSON file `my-sbom.bom.json` that\nwas generated from the tagged image\n`us-east1-docker.pkg.dev/my-image-repo/my-image`, and signs the SBOM reference\noccurrence with the KMS key version ending in `my-key/cryptoKeyVersions/1`. \n\n gcloud artifacts sbom load /\n --source=my-sbom.bom.json\n --uri=us-east1-docker.pkg.dev/my-image-repo/my-image\n --kms-key-version=projects/my-project/locations/us/keyRings/my-key-ring/cryptoKeys/my-key/cryptoKeyVersions/1\n\nThe following command uploads a JSON file `my-sbom.spdx.json` that is\nassociated with the image digest `my-local-image@sha256:abcxyz`, and stores\nthe file in the Cloud Storage bucket `gs://my-sbom-bucket`. \n\n gcloud artifacts sbom load /\n --source=my-sbom.spdx.json /\n --uri=my-local-image@sha256:abcxyz /\n --destination=gs://my-sbom-bucket\n\nArtifact Analysis uploads your SBOM to Cloud Storage and creates\nan SBOM [reference occurrence](/artifact-analysis/docs/sbom-overview#sbom-ref).\n\nYou can view SBOMs by using the Google Cloud console or the gcloud CLI.\nIf you want to locate the Cloud Storage bucket that contains your\nSBOMs, you must\n[search for SBOMs using the gcloud CLI](/artifact-analysis/docs/view-sboms-dependencies#gcloud).\n\nWhat's next\n-----------\n\n- [View SBOMs and dependencies](/artifact-analysis/docs/view-sboms-dependencies)."]]
