gcloud artifacts sbom load - upload an SBOM file and create a reference occurrence

gcloud artifacts sbom load--source=SOURCE--uri=ARTIFACT_URI[--destination=DESTINATION][--kms-key-version=KMS_KEY_VERSION][--location=LOCATION][GCLOUD_WIDE_FLAG …]

gcloudartifactssbomload--source=/path/to/sbom.json--uri=us-west1-docker.pkg.dev/my-project/my-repository/busy-box@sha256:abcxyz

To upload an SBOM file at /path/to/sbom.json for a Docker image with a KMS keyversion to sign the created SBOM reference:

gcloudartifactssbomload--source=/path/to/sbom.json--uri=us-west1-docker.pkg.dev/my-project/my-repository/busy-box@sha256:abcxyz--kms-key-version=projects/my-project/locations/us-west1/keyRings/my-key-ring/cryptoKeys/my-key/cryptoKeyVersions/1

To upload an SBOM file at /path/to/sbom.json for a Docker image from a Dockerregistry:

gcloudartifactssbomload--source=/path/to/sbom.json--uri=my-docker-registry/my-image@sha256:abcxyz--destination=gs://my-cloud-storage-bucket

--source=SOURCE

The SBOM file for uploading.

--uri=ARTIFACT_URI

The URI of the artifact the SBOM is generated from. The URI can be a Dockerimage from any Docker registries. A URI provided with a tag (e.g.[IMAGE]:[TAG]) will be resolved into a URI with a digest([IMAGE]@sha256:[DIGEST]). When passing an image which is not fromArtifact Registry or Container Registry with a tag, only public images can beresolved. Also, when passing an image which is not from Artifact Registry orContainer Registry, the--destination flag is required.

--destination=DESTINATION

The storage path will be used to store the SBOM file. Currently only supportsCloud Storage paths start with 'gs://'.

--kms-key-version=KMS_KEY_VERSION

Cloud KMS key version to sign the SBOM reference. The key version providedshould be the resource ID in the format ofprojects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]/cryptoKeyVersions/[KEY_VERSION].

--location=LOCATION

If specified, all requests to Artifact Analysis for occurrences will go tolocation specified

Run$gcloud help for details.