Upload a release: SBOM or lock files

Each release of a product has its own software bill of materials (SBOM). Provetry keeps them all: you can always say which versions in the field contain a given component.

What you can upload

• An SBOM in CycloneDX or SPDX (JSON), produced by your build.
• Lock files of the main package managers (npm, pnpm, Yarn, Cargo, Poetry, uv, pip, Composer, Bundler, NuGet, Gradle, Maven…), with the manifest next to them so Provetry can tell direct dependencies from the others.

Steps

1. Open the product, then Upload a release.
2. Type the version number and choose the files.
3. Click Upload and scan. The results appear within a minute.

Provetry writes the SBOM in CycloneDX 1.6 (every plan) and in SPDX 2.3 and 3.0.1 (paid plans); each can be downloaded from the release. CycloneDX 1.6 and SPDX 3.0.1 are the versions Germany’s BSI asks for. You can also upload an SPDX 3 file (JSON-LD).

From a GitHub repository

Under Import from GitHub, give the address of the repository, and if you wish a branch or tag (the default branch otherwise) and the version (the commit’s first seven characters otherwise). Provetry reads the lock files of that commit through the GitHub API, with their manifests, and leaves out vendored, test and example folders. Nothing changes in your CI, and nothing is cloned or executed.

For a private repository, give a fine-grained token with read access to the contents of that repository only. It is sent to GitHub for this import and never stored. The repository and the commit are recorded in the evidence journal with the release.

Supported releases

Every release marked supported is checked every day (every week on Free). On paid plans, a release is also checked again within the hour when OSV.dev publishes or updates a vulnerability in one of its packages, and the lists of exploited vulnerabilities are also reread regularly (CISA KEV every hour, ENISA EUVD every six hours): a vulnerability already found in a release is usually flagged as exploited within the hour of its listing in KEV, within six hours for an entry listed only in EUVD. When a version leaves the field, click No longer supported: it keeps its history but is no longer watched.

If a vulnerability source did not answer during a check, the release says the result is incomplete, and the next check completes it.