How setup SBOM?

[marverix]

Hello,

how does SBOM works with bake-action plugin? I read the bakefile reference and added attest object to my docker-bake.override.json, which is correctly parsed by the action:

Parsing raw definition
  /usr/local/bin/docker buildx bake --push --print
  #1 [internal] load local bake definitions
  #1 reading docker-bake.json 1.10kB / 1.10kB done
  #1 reading docker-bake.override.json 2.33kB / 2.33kB done
  #1 DONE 0.0s
  {
    "group": {
      "default": {
        "targets": [
          "[redacted]",
          "[redacted]",
          "[redacted]"
        ]
      }
    },
    "target": {
      "[redacted]": {
        "attest": [
          {
            "mode": "min",
            "type": "provenance"
          },
          {
            "type": "sbom"
          }
        ],

and later I see that indeed something is going on:

#129 [[redacted] linux/amd64] generating sbom using docker.io/docker/buildkit-syft-scanner:stable-1
#129 0.107 time="2025-08-28T12:06:16Z" level=info msg="starting syft scanner for buildkit v1.9.0"
#129 DONE 1.5s

But that's it. When I go to Docker Hub, I still see the alert:

I read the documentation, and I'm using sbom only with push: true.

[crazy-max]

Is your image public so we can look at it? You can also check locally with: https://docs.docker.com/reference/cli/docker/buildx/imagetools/inspect

docker buildx imagetools inspect <image> --format "{{json .SBOM}}"

Like

docker buildx imagetools inspect moby/buildkit --format "{{json .SBOM}}"

[marverix]

Ok, I figured this out. Scout needs special generator:

{
  "type": "sbom",
  "generator": "docker/scout-sbom-indexer:latest"
}

Here is the docs: https://docs.docker.com/scout/how-tos/view-create-sboms/#attest