SBOM
Know the exact version and license of every package that a Zato installation runs.
Zato ships with a Software Bill of Materials (SBOM) in the CycloneDX 1.6 JSON format.
The document lists every Python package installed in the Zato environment, including its exact version, license and package URL (PURL), which lets you feed it into dependency-scanning and compliance tooling.
The SBOM is generated with cyclonedx-bom directly from the installed environment, so it always describes what is actually running, not what a requirements file lists.
Docker images
Every Zato Docker image includes its own SBOM at the following path inside the container:
To extract it from an image without running a container, use docker create and docker cp:
docker create --name zato-sbom-tmp ghcr.io/zatosource/zato-4.1:latest
docker cp zato-sbom-tmp:/opt/zato/4.1/sbom/zato.cdx.json ./zato-4.1.cdx.json
docker rm zato-sbom-tmp
Dashboard
In a running environment, the SBOM is available in Dashboard under System → SBOM. The page shows the full document and includes a copy button for the document.
Verify the registry attestation
Images pushed to ghcr.io have their SBOM attached as a signed CycloneDX attestation created with cosign. To verify and download it:
The verification confirms both that the SBOM belongs to that exact image and that the Zato release pipeline produced it.
See also
| Page | What it covers |
|---|---|
| Updates | Installing the releases whose packages the SBOM lists |
| PII | Data protection controls for the environments that the SBOM describes |
| Production security checklist | The wider set of checks before an environment goes live |