diff --git a/website/content/docs/provisioners/hcp_sbom.mdx b/website/content/docs/provisioners/hcp_sbom.mdx new file mode 100644 index 00000000000..46fc1ad6756 --- /dev/null +++ b/website/content/docs/provisioners/hcp_sbom.mdx @@ -0,0 +1,39 @@ +--- +page_title: hcp-sbom provisioner reference +description: |- + The hcp-sbom Packer provisioner uploads a CycloneDX or SPDX JSON-formatted software bill of materials record to HCP Packer. +--- + + + + + +# `hcp-sbom` provisioner reference + +The `hcp-sbom` provisioner uploads software bill of materials (SBOM) files from artifacts built by Packer to HCP Packer. You must format SBOM files you want to upload as JSON and follow either the [SPDX](https://spdx.github.io/spdx-spec/latest) or [CycloneDX](https://cyclonedx.org/) specification. HCP Packer links these SBOM files to the version of the artifact that Packer builds. + +## Example + +The following example uploads an SBOM from the local `/tmp` directory and stores a copy in the `/sboms-catalog` directory on the local machine: + +```hcl +provisioner "hcp-sbom" { + source = "/tmp/sbom_cyclonedx.json" + sbom_name = "my_sbom" + destination = "./sbom_cyclonedx.json" +} +``` + +## Configuration reference + +You can specify the following configuration options. + +Required parameters: + +- `source` (string) - The path to the SBOM file in the Packer artifact. This file must either be in the SPDX or CycloneDX format. + +Optional parameters: + +- `sbom_name` (string) - The name of the SBOM file stored in HCP Packer. If omitted, HCP Packer uses the build fingerprint as the file name. This value must be between three and 36 characters from the following set: `[A-Za-z0-9_-]`. + +- `destination` (string) - The path on the local machine to store a copy of the SBOM file. You can specify an absolute or a path relative to the working directory when you execute the Packer build. diff --git a/website/content/docs/provisioners/index.mdx b/website/content/docs/provisioners/index.mdx index e6144beaef4..8d39857d372 100644 --- a/website/content/docs/provisioners/index.mdx +++ b/website/content/docs/provisioners/index.mdx @@ -29,6 +29,8 @@ The following provisioners are included with Packer: machine images during a build. - [Windows Restart](/packer/docs/provisioners/windows-restart) - initiate a reboot on a Windows machine images during a build. +- [HCP Software Bill of Materials](/packer/docs/provisioners/hcp_sbom) - Upload an SBOM and + associate it with an artifact version in the HCP Packer registry. Additional [Community Supported](/packer/docs/provisioners/community-supported) provisioners are developed and maintained by various members of the community. diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json index 24c55feb678..2e0412b05ce 100644 --- a/website/data/docs-nav-data.json +++ b/website/data/docs-nav-data.json @@ -804,6 +804,10 @@ "title": "Windows Restart", "path": "provisioners/windows-restart" }, + { + "title": "HCP Software Bill of Materials", + "path": "provisioners/hcp_sbom" + }, { "title": "Custom", "path": "provisioners/custom"