Verify the Contents of Published OpenShell Images

Published gateway and supervisor images carry one SPDX SBOM per platform as OCI attestations.

Inspect an Image

Read a platform’s document without pulling the image:

$
docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:latest --format '{{ json (index .SBOM "linux/amd64").SPDX }}'

List the packages instead of the full document:

$
docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:latest --format '{{ range (index .SBOM "linux/amd64").SPDX.packages }}{{ .name }}@{{ .versionInfo }}{{ println }}{{ end }}'

The same commands work for ghcr.io/nvidia/openshell/supervisor.

Coverage

Every SBOM lists the base-image packages. Release Dev and Release Tag images also list the Rust crates compiled into their OpenShell binary.