Software Bill of Materials

Ghostunnel releases ship with a Software Bill of Materials (SBOM) listing the Go modules compiled into each binary, including the Go standard library version. SBOMs are generated from the compiled binaries themselves (via the Go build information embedded by the toolchain), so they reflect exactly what was linked into a given artifact.

Release binaries #

Each binary on the GitHub releases page has two SBOM files next to it, in SPDX 2.3 and CycloneDX JSON format:

The same pattern applies to every other binary in a release. The SPDX document also records the SHA-256 checksum of the binary it describes, so you can confirm which file an SBOM belongs to:

jq -r '.files[0].checksums[] | select(.algorithm=="SHA256") | .checksumValue' ghostunnel-linux-amd64.spdx.json
sha256sum ghostunnel-linux-amd64    # shasum -a 256 on macOS

To list the modules in a binary:

jq -r '.packages[] | "\(.name) \(.versionInfo)"' ghostunnel-linux-amd64.spdx.json

Docker images #

Images published to Docker Hub carry an SBOM attestation generated by BuildKit, attached to the image index alongside the provenance attestation. It covers both the Ghostunnel binary and the packages of the base image (Alpine, Debian or distroless).

To retrieve it:

docker buildx imagetools inspect ghostunnel/ghostunnel:latest --format '{{ json .SBOM }}'

Generating SBOMs locally #

The release SBOMs are produced by the sbom:generate build target, which requires Syft on your PATH:

brew install syft            # or see the Syft README for other platforms
go tool mage go:build
go tool mage sbom:generate ghostunnel

This writes ghostunnel.spdx.json and ghostunnel.cdx.json next to the binary.