Software Bill of Materials (SBOM)

A software bill of materials (SBOM) lists every component inside a piece of software: its name, version, license and where it comes from. Use it to check ThingsBoard against vulnerability databases, to review licenses, or to meet a compliance requirement.

ThingsBoard publishes SBOMs starting with version 4.4.1. Each SBOM is a CycloneDX 1.6 JSON file. The SBOM of a package names the SHA-256 hash of the package, and the SBOM of an image names the image digest, so you can tell exactly which artifact it describes.

Download the SBOM from the release page the same way as the package:

wget https://github.com/thingsboard/thingsboard/releases/download/v4.4.0.2/thingsboard-4.4.0.2.deb.cdx.json

To check that an SBOM belongs to the package you have, compare the hash it records with the hash of your file:

sha256sum thingsboard-4.4.0.2.deb
jq -r '.metadata.component.hashes[] | select(.alg == "SHA-256") | .content' thingsboard-4.4.0.2.deb.cdx.json

The SBOM of an image is stored in the registry and linked to the image, so the image itself stays unchanged. Each architecture (linux/amd64, linux/arm64) has its own SBOM.

You need the ORAS command-line tool to download it.

1. Find the SBOM attached to the image for your architecture:

   oras discover --platform linux/amd64 \
   --artifact-type application/vnd.cyclonedx+json \
   docker.io/thingsboard/tb-node:4.4.0.2

   The output shows the image digest and, below it, the digest of the SBOM:

   docker.io/thingsboard/tb-node@sha256:2a84…
   └── application/vnd.cyclonedx+json
       └── sha256:64f8…
           └── [annotations]
               └── org.opencontainers.image.created: "2026-11-10T10:10:07Z"

2. Download the SBOM by its digest:

   oras pull docker.io/thingsboard/tb-node@<SBOM digest from step 1>

   ORAS saves the file to the current directory as thingsboard_tb-node_<version>_<architecture>_<first 12 characters of the image digest>.cdx.json.

Use the same commands for the other images, for example thingsboard/tb-mqtt-transport or thingsboard/tb-web-ui.

Read the SBOM of a jar from an installed system, without a download:

unzip -p /usr/share/thingsboard/bin/thingsboard.jar META-INF/sbom/application.cdx.json > thingsboard.cdx.json

To scan an SBOM for known vulnerabilities:

trivy sbom thingsboard-4.4.0.2.deb.cdx.json
grype sbom:thingsboard-4.4.0.2.deb.cdx.json

You can also upload the file to Dependency-Track to follow new vulnerabilities over time.