Generating ConcertDef SBOMs

Edit online

Use software bill of materials (SBOM) files in the ConcertDef (Concert-defined) format to build application, environment, and deployment topologies in IBM Concert. ConcertDef SBOMs describe your applications, software components, deployment environments, runtime infrastructure, and the relationships between them.

IBM Concert supports both the ConcertDef 2.0.0 and ConcertDef 1.0.2 specifications. ConcertDef 1.0.2 is deprecated and is supported only for compatibility with existing integrations. IBM recommends using the ConcertDef 2.0.0 specification for all new integrations. Support for the ConcertDef 1.0.2 specification might be removed in a future IBM Concert release.

The ConcertDef JSON schema represents the Concert-defined data model that IBM Concert uses to build and maintain a 360-degree topological view of your applications and deployments across environments.

The Application SBOM defines an application version and the complete set of software components that belong to that application version at a specific point in time. IBM Concert uses the Application SBOM to define the application metadata, source code repositories, build artifacts, and the associations between them, which together form the application topology.

The Deploy SBOM defines where an application version is deployed. It represents the runtime manifestation of the build artifacts that are defined in an Application SBOM, including deployment environments, runtime components, deployed workloads, services and associated endpoints, and deployment dependencies. IBM Concert uses this information to associate runtime environments with the corresponding application version and maintain deployment topology.

Considerations when generating ConcertDef SBOMs

  • Generate one Application SBOM for each application version. An Application SBOM always represents the complete definition of an application version.
  • Application SBOMs must contain the complete list of components that belong to the application version. Incremental updates are not supported.
  • To add component definitions that group repositories and build artifacts to an existing application, include both the existing component definitions and the new component definitions in the uploaded Application SBOM. Uploading an Application SBOM that contains only the new component definitions replaces the existing application definition and removes previously defined components.
  • The ConcertDef 2.0.0 Application SBOM specification does not support defining environments, deployments, or runtime infrastructure. Use a Deploy SBOM to define deployment environments, runtime components, deployed workloads, services, and deployment dependencies.
  • Generate one Deploy SBOM for each deployment of an application version. Each Deploy SBOM represents a single deployment at a specific point in time.
  • A Deploy SBOM can reference an existing application version or create a new application version if one does not already exist. When an Application SBOM already exists, IBM Concert associates the deployment with the existing application version and incrementally appends newly discovered runtime components to the application definition.
  • Build SBOMs are deprecated and are supported only for compatibility with existing ConcertDef 1.0.2 integrations. IBM recommends using the ConcertDef 2.0.0 Application SBOM schema for new integrations.
  • Ensure that the timestamps in uploaded SBOMs accurately represent the application lifecycle. For Deploy SBOMs, the deployment timestamp must be later than the corresponding Application SBOM timestamp or the application creation time if the application already exists.

The ConcertDef schema is an IBM-defined specification that is modeled on the CycloneDX SBOM schema. Concert-defined SBOMs can be generated by using the Concert toolkit or custom scripts, such as Jenkins or Argo CD, and then uploaded to IBM Concert manually or automatically through your CI/CD pipeline (recommended).

You can use the Concert toolkit to automatically generate and upload SBOM files in the supported ConcertDef formats.