PSMDB-2150-SBOM into PSMDB binary packages

[rasika-chivate]

Create a section for Software Bills of Materials (SBOMs) for Percona Server for MongoDB.

For more details, see the ticket:

https://perconadev.atlassian.net/browse/PSMDB-1794

[Copilot]

Pull request overview

Adds end-user documentation for Software Bills of Materials (SBOMs) in Percona Server for MongoDB (PSMDB) and exposes it in the MkDocs navigation.

Changes:

• Adds a new documentation page describing where to find PSMDB SBOMs and how to verify/scan them.
• Updates MkDocs navigation to include the new SBOM page under the “Reference” section.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
mkdocs-base.yml	Adds the SBOM page to the “Reference” nav section so it appears in the published docs.
docs/sbom.md	Introduces SBOM documentation with locations and example commands for tarball/RPM/DEB/Docker.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (5)

docs/sbom.md:34

• The binary tarball example is grepping for percona-server-mongodb.cdx.json, but the SBOM filename/location described above is doc/percona-server-mongodb/sbom.cdx.json. This makes the verification step fail even when the SBOM is present.

tar tzf percona-server-mongodb-{{release}}-x86_64.<operating-system>.tar.gz | grep percona-server-mongodb.cdx.json

docs/sbom.md:40

• The extract+scan commands use percona-server-mongodb/percona-server-mongodb.cdx.json, which doesn’t match the SBOM path documented in the table (doc/percona-server-mongodb/sbom.cdx.json). Update the example to extract/scan the same SBOM path.

tar xzf percona-server-mongodb-{{release}}-x86_64.<operating-system>.tar.gz \
    -C /tmp percona-server-mongodb/percona-server-mongodb.cdx.json
trivy sbom --severity HIGH,CRITICAL --ignore-unfixed \
    /tmp/percona-server-mongodb/percona-server-mongodb.cdx.json

docs/sbom.md:51

• The RPM scan example references /usr/share/doc/percona-server-mongodb-server.cdx.json, but the SBOM location listed above is /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json. As written, the command points to a non-existent path.

trivy sbom --severity HIGH,CRITICAL --ignore-unfixed --distro redhat/9.x \
    /usr/share/doc/percona-server-mongodb-server.cdx.json

docs/sbom.md:62

• The DEB scan example references /usr/share/doc/percona-server-mongodb-server.cdx.json, but the SBOM location listed above is /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json. Update the command to scan the documented file.

trivy sbom --severity HIGH,CRITICAL --ignore-unfixed \
    /usr/share/doc/percona-server-mongodb-server.cdx.json

docs/sbom.md:91

• The embedded SBOM scan example uses /usr/share/doc/percona-server-mongodb-server.cdx.json, which is inconsistent with the SBOM path documented earlier (/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json).

    docker.io/percona/percona-server-mongodb-server \
    /usr/share/doc/percona-server-mongodb-server.cdx.json \
    | trivy sbom --severity HIGH,CRITICAL --ignore-unfixed -

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (4)

docs/sbom.md:38

• The binary tarball example uses inconsistent SBOM filenames/paths (it references percona-server-mongodb.cdx.json, while the table above specifies doc/percona-server-mongodb/sbom.cdx.json). This makes the verification/extraction commands likely to fail; please align the commands with the documented SBOM location.

tar tzf percona-server-mongodb-{{release}}-x86_64.<operating-system>.tar.gz | grep percona-server-mongodb.cdx.json

# Extract and scan
tar xzf percona-server-mongodb-{{release}}-x86_64.<operating-system>.tar.gz \
    -C /tmp percona-server-mongodb/percona-server-mongodb.cdx.json

docs/sbom.md:51

• RPM scanning example points to /usr/share/doc/percona-server-mongodb-server.cdx.json, but the SBOM location table indicates the file lives under /usr/share/doc/percona-server-mongodb-server/ and is named sbom.cdx.json. As written, the scan command won't find the file.

trivy sbom --severity HIGH,CRITICAL --ignore-unfixed --distro redhat/9.x \
    /usr/share/doc/percona-server-mongodb-server.cdx.json

docs/sbom.md:62

• DEB scanning example points to /usr/share/doc/percona-server-mongodb-server.cdx.json, but the SBOM location table indicates the file lives under /usr/share/doc/percona-server-mongodb-server/ and is named sbom.cdx.json. As written, the scan command won't find the file.

trivy sbom --severity HIGH,CRITICAL --ignore-unfixed \
    /usr/share/doc/percona-server-mongodb-server.cdx.json

docs/sbom.md:91

• The Docker embedded SBOM example uses /usr/share/doc/percona-server-mongodb-server.cdx.json, but earlier you document the embedded SBOM path as /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json. Using the wrong path will make cat fail.

    docker.io/percona/percona-server-mongodb-server \
    /usr/share/doc/percona-server-mongodb-server.cdx.json \
    | trivy sbom --severity HIGH,CRITICAL --ignore-unfixed -

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (4)

docs/sbom.md:52

• The RPM scan path uses a dotted filename (...-server.sbom.cdx.json) but the table above (and typical RPM doc install layout) indicates the SBOM should be under /usr/share/doc/<package>/sbom.cdx.json. This makes the copy/paste command incorrect.

# Scan it (replace 9.x with your RHEL/OL version)
trivy sbom --severity HIGH,CRITICAL --ignore-unfixed --distro redhat/9.x \
    /usr/share/doc/percona-server-mongodb-server.sbom.cdx.json

**docs/sbom.md:63**
* The DEB scan path uses a dotted filename (`...-server.sbom.cdx.json`) but the expected location is `/usr/share/doc/<package>/sbom.cdx.json` (and that’s what the table above documents).

Scan it

trivy sbom --severity HIGH,CRITICAL --ignore-unfixed
/usr/share/doc/percona-server-mongodb-server.sbom.cdx.json

docs/sbom.md:92

• For piping JSON out of a container into trivy sbom, allocating a TTY (-t) can introduce formatting issues; also the SBOM path here uses percona-server-mongodb while the rest of the page documents the percona-server-mongodb-server doc path. Consider removing -t and using a consistent SBOM file location.

docker run --rm -it --entrypoint cat \
    docker.io/percona/percona-server-mongodb \
    /usr/share/doc/percona-server-mongodb/sbom.cdx.json \
    | trivy sbom --severity HIGH,CRITICAL --ignore-unfixed -

**docs/sbom.md:40**
* In the tarball example, the SBOM filename/path doesn’t match the location table (`doc/percona-server-mongodb/sbom.cdx.json`) or the tarball directory naming used in the install docs. Updating the commands to search for the documented path and scan the extracted SBOM should make the example work.

tar tzf percona-server-mongodb-{{release}}-x86_64..tar.gz | grep percona-server-mongodb.sbom.cdx.json

Extract and scan

tar xzf percona-server-mongodb-{{release}}-x86_64..tar.gz
-C /tmp percona-server-mongodb/percona-server-mongodb.sbom.cdx.json
trivy sbom --severity HIGH,CRITICAL --ignore-unfixed
/tmp/percona-server-mongodb/percona-server-mongodb.sbom.cdx.json

</details>