Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como fazer upload de um arquivo de lista de materiais de software (SBOM) para o Cloud Storage para ajudar a rastrear e atestar os componentes das imagens de contêiner armazenadas no Artifact Registry.
Para informações sobre preços do Cloud Storage, consulte
Preços.
Para inicializar a gcloud CLI, execute o seguinte comando:
gcloudinit
Ter um repositório do Docker no Artifact Registry com a imagem do contêiner que sua lista de materiais de software descreve. Se você não estiver familiarizado com o Artifact Registry, consulte o
Guia de início rápido do Docker.
Tenha um arquivo de lista de materiais de software pronto para upload em um dos formatos compatíveis.
Funções exigidas
Para receber as permissões necessárias para criar e gerenciar buckets do Cloud Storage e arquivos de lista de materiais de software (SBOM), peça ao administrador para conceder a você os seguintes papéis do IAM no projeto:
Se você estiver usando o bucket padrão do Cloud Storage, para gerenciar buckets de armazenamento:
Administrador de armazenamento(roles/storage.admin)
Se você estiver especificando um bucket do Cloud Storage, para gerenciar buckets de armazenamento:
Administrador de objetos do Storage(roles/storage.objectAdmin)
Para criar uma nota para ocorrências de referência de SBOM no projeto atual:
Editor de notas do Container Analysis((roles/containeranalysis.notes.editor)
Para criar uma ocorrência de referência de SBOM:
Editor de ocorrências do Container Analysis(roles/containeranalysis.occurrences.editor)
Fazer upload da sua lista de materiais de software
Use o comando a seguir para fazer upload da sua lista de materiais de software:
gcloudartifactssbomload/
--sourceSOURCE/
--uriURI
Em que:
SOURCE: o caminho para o arquivo da lista de materiais de software (SBOM) a ser enviado.
URI: o URI da imagem do Docker que o arquivo da lista de materiais de software descreve.
As imagens podem estar no formato de tag ou de resumo. As imagens fornecidas no formato de tag serão resolvidas no formato de resumo.
Flags opcionais
--destination: especifica um bucket do Cloud Storage para usar em vez do padrão.
--kms-key-version: fornece uma versão de chave para assinar o payload da ocorrência
de referência da SBOM. Você pode usar essa chave para verificar a origem da lista de materiais de software.
Por exemplo, o comando a seguir faz upload de um arquivo JSON my-sbom.bom.json que
foi gerado da imagem com tag
us-east1-docker.pkg.dev/my-image-repo/my-image e assina a ocorrência de referência da lista de materiais de software
com a versão da chave do KMS que termina em my-key/cryptoKeyVersions/1.
O comando a seguir faz upload de um arquivo JSON my-sbom.spdx.json associado ao resumo da imagem my-local-image@sha256:abcxyz e armazena o arquivo no bucket do Cloud Storage gs://my-sbom-bucket.
O Artifact Analysis faz upload da sua lista de materiais de software para o Cloud Storage e cria uma ocorrência de referência da lista.
É possível conferir as listas de materiais de software usando o console Google Cloud ou a CLI gcloud.
Se você quiser localizar o bucket do Cloud Storage que contém suas
SBOMs, pesquise SBOMs usando a CLI gcloud.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-03 UTC."],[[["\u003cp\u003eThis page explains how to upload a Software Bill of Materials (SBOM) file to Cloud Storage for tracking and attesting to the components of container images in Artifact Registry.\u003c/p\u003e\n"],["\u003cp\u003eBefore uploading, you need a Docker repository in Artifact Registry with the relevant container image and an SBOM file in either SPDX (version 2.2 or 2.3) or CycloneDX (version 1.4 or 1.5) format.\u003c/p\u003e\n"],["\u003cp\u003eUploading an SBOM involves using the \u003ccode\u003egcloud artifacts sbom load\u003c/code\u003e command, specifying the SBOM file's source path and the URI of the associated Docker image.\u003c/p\u003e\n"],["\u003cp\u003eYou can optionally designate a specific Cloud Storage bucket for storing the SBOMs and sign the SBOM reference occurrence with a KMS key version for origin verification.\u003c/p\u003e\n"],["\u003cp\u003eAfter uploading, Artifact Analysis stores the SBOM in Cloud Storage and creates an SBOM reference occurrence that can be viewed through the Google Cloud console or the gcloud CLI.\u003c/p\u003e\n"]]],[],null,["# Upload SBOMs\n\nThis page describes how to upload a software bill of materials (SBOM) file to\nCloud Storage to help track and attest to the components of container images\nyou store in Artifact Registry.\n\nFor information on Cloud Storage pricing, see\n[Pricing](https://cloud.google.com/storage/pricing).\n\nBefore you begin\n----------------\n\n- [Sign in](https://accounts.google.com/Login) to your Google Account.\n\n If you don't already have one, [sign up for a new account](https://accounts.google.com/SignUp).\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Artifact Registry, Container Analysis APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://artifactregistry.googleapis.com, https://containeranalysis.googleapis.com,)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Artifact Registry, Container Analysis APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://artifactregistry.googleapis.com, https://containeranalysis.googleapis.com,)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. Have a Docker repository in Artifact Registry with the container image that your SBOM describes. If you are not familiar with Artifact Registry, see the [Docker quickstart](/artifact-registry/docs/docker/store-docker-container-images).\n2. Have an SBOM file ready to upload in one of the [supported formats](/artifact-analysis/docs/upload-sbom#formats).\n\n\u003cbr /\u003e\n\n### Required roles\n\n\nTo get the permissions that\nyou need to create and manage Cloud Storage buckets and SBOM files ,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- If you are using the default Cloud Storage bucket, to manage storage buckets: Storage Admin(`roles/storage.admin`)\n- If you are specifying a Cloud Storage bucket, to manage storage buckets: Storage Object Admin(`roles/storage.objectAdmin`)\n- If a note for the SBOM reference already exists: [Container Analysis Notes Attacher](/iam/docs/roles-permissions/containeranalysis#containeranalysis.notes.attacher) (`roles/containeranalysis.notes.attacher`)\n- To create a new note for SBOM reference occurrences in the current project: Container Analysis Notes Editor(`(roles/containeranalysis.notes.editor`)\n- To create an SBOM reference occurrence: Container Analysis Occurrences Editor(`roles/containeranalysis.occurrences.editor`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nSupported formats\n-----------------\n\nYour SBOM file must be a JSON file in one of the following formats:\n\n- [Software Package Data Exchange (SPDX)](https://spdx.dev/) version 2.2 or 2.3\n- [CycloneDX](https://cyclonedx.org/) version 1.4 or 1.5\n\nUpload your SBOM\n----------------\n\nUse the following command to upload your SBOM: \n\n gcloud artifacts sbom load /\n --source \u003cvar translate=\"no\"\u003eSOURCE\u003c/var\u003e /\n --uri \u003cvar translate=\"no\"\u003eURI\u003c/var\u003e\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eSOURCE\u003c/var\u003e: the path to the SBOM file to upload.\n- \u003cvar translate=\"no\"\u003eURI\u003c/var\u003e: the URI for the Docker image that the SBOM file describes. Images can be in either tag format, or digest format. Images provided in tag format will be resolved into digest format.\n\n### Optional flags\n\n- `--destination`: specifies a Cloud Storage bucket to use instead of the default one.\n- `--kms-key-version`: provides a key version to sign the SBOM reference occurrence payload. You can use this key to verify the origin of the SBOM.\n\nFor example, the following command uploads a JSON file `my-sbom.bom.json` that\nwas generated from the tagged image\n`us-east1-docker.pkg.dev/my-image-repo/my-image`, and signs the SBOM reference\noccurrence with the KMS key version ending in `my-key/cryptoKeyVersions/1`. \n\n gcloud artifacts sbom load /\n --source=my-sbom.bom.json\n --uri=us-east1-docker.pkg.dev/my-image-repo/my-image\n --kms-key-version=projects/my-project/locations/us/keyRings/my-key-ring/cryptoKeys/my-key/cryptoKeyVersions/1\n\nThe following command uploads a JSON file `my-sbom.spdx.json` that is\nassociated with the image digest `my-local-image@sha256:abcxyz`, and stores\nthe file in the Cloud Storage bucket `gs://my-sbom-bucket`. \n\n gcloud artifacts sbom load /\n --source=my-sbom.spdx.json /\n --uri=my-local-image@sha256:abcxyz /\n --destination=gs://my-sbom-bucket\n\nArtifact Analysis uploads your SBOM to Cloud Storage and creates\nan SBOM [reference occurrence](/artifact-analysis/docs/sbom-overview#sbom-ref).\n\nYou can view SBOMs by using the Google Cloud console or the gcloud CLI.\nIf you want to locate the Cloud Storage bucket that contains your\nSBOMs, you must\n[search for SBOMs using the gcloud CLI](/artifact-analysis/docs/view-sboms-dependencies#gcloud).\n\nWhat's next\n-----------\n\n- [View SBOMs and dependencies](/artifact-analysis/docs/view-sboms-dependencies)."]]
