slsactl

The slsactl is a Command Line Interface (CLI) tool to provide a consolidated experience while handling supply chain aspects of projects across the Rancher ecosystem.

Installation

Go

go install github.com/rancherlabs/slsactl@latest

Usage

Provenance

The provenance data can be extracted from an image with the command below. Note that the image must have been built with a Provenance layer baked to it.

slsactl download provenance rancher/cis-operator:v1.0.15
slsactl download provenance --format=slsav1 rancher/cis-operator:v1.0.15

By default, the returned provenance will be for linux/amd64, if one exists. To select a different platform use --platform.

SBOM

The latest container images have baked into them a layer containing their SPDX SBOM, which can be extracted with:

slsactl download sbom rancher/cis-operator:v1.0.15

If Cyclonedx is required instead:

slsactl download sbom -format cyclonedxjson rancher/cis-operator:v1.0.15

By default, the returned provenance will be for linux/amd64, if one exists. To select a different platform use --platform.

Note that images that haven’t got a SBOM…