Percona Backup for MongoDB (PBM) 2.15.0 and Percona ClusterSync for MongoDB (PCSM) 0.9.0 now ship a CycloneDX 1.6 Software Bill of Materials (SBOM) with every release artifact — binary tarballs, RPM/DEB packages, and Docker images. The SBOM is generated with Syft from the actual built binary, making it accurate rather than inferred from source. Docker images carry two SBOMs: an embedded one covering Go modules and an OCI-attached one covering the full image including base OS packages. Operators can scan these with Trivy, Grype, or any CycloneDX-compatible tool to answer CVE exposure questions in seconds. The post walks through three scanning workflows: scanning a local file, using Trivy's --sbom-sources oci flag against a registry image, and inspecting OCI artifacts directly with the ORAS CLI. Future releases will add VEX documents to record exploitability determinations per finding.
