# SBOM

Know the exact version and license of every package that a Zato installation runs.

Zato ships with a Software Bill of Materials (SBOM) in the [CycloneDX](https://cyclonedx.org) 1.6 JSON format.

The document lists every Python package installed in the Zato environment, including its exact version, license and package URL (PURL), which lets you feed it into dependency-scanning and compliance tooling.

The SBOM is generated with [cyclonedx-bom](https://pypi.org/project/cyclonedx-bom/) directly from the installed environment, so it always describes what is actually running, not what a requirements file lists.

## Docker images {#docker-images}

Every Zato Docker image includes its own SBOM at the following path inside the container:

```text
/opt/zato/4.1/sbom/zato.cdx.json
```

To extract it from an image without running a container, use `docker create` and `docker cp`:

```bash
docker create --name zato-sbom-tmp ghcr.io/zatosource/zato-4.1:latest
docker cp zato-sbom-tmp:/opt/zato/4.1/sbom/zato.cdx.json ./zato-4.1.cdx.json
docker rm zato-sbom-tmp
```

## Dashboard {#dashboard}

In a running environment, the SBOM is available in Dashboard under **System → SBOM**. The page shows the full document and includes a copy button for the document.

## Verify the registry attestation {#verify-the-registry-attestation}

Images pushed to ghcr.io have their SBOM attached as a signed CycloneDX attestation created with [cosign](https://github.com/sigstore/cosign). To verify and download it:

```bash
cosign verify-attestation --type cyclonedx ghcr.io/zatosource/zato-4.1:latest
```

The verification confirms both that the SBOM belongs to that exact image and that the Zato release pipeline produced it.

## See also {#see-also}

- [Updates](https://zato.io/docs/admin/guide/install/update.html) - Installing the releases whose packages the SBOM lists
- [PII](https://zato.io/docs/admin/security/pii.html) - Data protection controls for the environments that the SBOM describes
- [Production security checklist](https://zato.io/docs/admin/security/checklist.html) - The wider set of checks before an environment goes live

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere