Software Bill of Materials (SBOM)

The RCAN protocol requires all robots to publish a CycloneDX 1.5 SBOM to the Robot Registry Foundation (RRF). The RRF countersigns the SBOM, creating a verifiable supply chain record for every robot.

EU AI Act — supporting evidence
An SBOM can support the technical documentation and traceability a provider of a high-risk AI system has to keep. It does not by itself meet Art. 13, which concerns transparency and instructions for use. An RRF countersignature shows that RRF received the SBOM; RRF is run by RCAN's maintainer, so it is not third-party verification.

1. Generate

castor sbom generate scans installed Python packages and builds a CycloneDX SBOM with an x-rcan extension block containing your robot's RRN and spec version.

Terminal
# Generate CycloneDX SBOM
castor sbom generate --config ~/opencastor/bob.rcan.yaml

# Output:
# ✓ SBOM generated: /tmp/opencastor-rcan-sbom.json
#   RRN:        RRN-000000000001
#   Components: 512
#   Serial:     urn:uuid:579cf9da-f6b4-4d90-b27c-cb7edabe03df
#   attestation_ref: https://api.rrf.rcan.dev/v2/robots/RRN-000000000001/sbom

2. Publish to RRF

castor sbom publish pushes the SBOM to the RRF and receives a countersignature. The RRF countersig is an Ed25519 signature from the RRF root key over the SBOM SHA-256 hash.

Terminal
# Publish to RRF (requires robot JWT token)
castor sbom publish --token $(cat ~/.config/opencastor/bob-rrf-token.txt)

# Output:
# ✓ SBOM published and countersigned by RRF
#   rrf_countersig: LCcgjlfXIKjuWgVWD...

3. SBOM Schema

Terminal
{
  "bomFormat":    "CycloneDX",
  "specVersion":  "1.5",
  "serialNumber": "urn:uuid:579cf9da-f6b4-4d90-b27c-cb7edabe03df",
  "version":      1,
  "metadata": {
    "timestamp": "2026-03-27T00:50:00Z",
    "component": {
      "type":    "device",
      "name":    "opencastor-rpi5-bob",
      "version": "2026.3.27.0"
    }
  },
  "components": [
    {
      "type":    "library",
      "name":    "opencastor",
      "version": "2026.3.27.0",
      "hashes":  [{ "alg": "SHA-256", "content": "a1b2c3..." }],
      "purl":    "pkg:pypi/opencastor@2026.3.27.0"
    },
    {
      "type":    "library",
      "name":    "rcan",
      "version": "1.2.1",
      "hashes":  [{ "alg": "SHA-256", "content": "d4e5f6..." }],
      "purl":    "pkg:pypi/rcan@1.2.1"
    }
  ],
  "x-rcan": {
    "rrn":            "RRN-000000000001",
    "spec_version":   "2.2.0",
    "attestation_ref": "https://api.rrf.rcan.dev/v2/robots/RRN-000000000001/sbom"
  }
}

4. Verify

Anyone can verify your SBOM by fetching it from the RRF API and checking the countersignature against the published RRF root public key.

Terminal
# Verify RRF countersignature
castor sbom verify

# Or fetch directly from RRF
curl https://api.rrf.rcan.dev/v2/robots/RRN-000000000001/sbom

5. Gateway Endpoint

The OpenCastor gateway exposes SBOM data directly:

  • GET /api/sbom — metadata (serial, component count, attestation_ref)
  • GET /api/sbom/download — full CycloneDX JSON

Reference

Edit this page on GitHub Last updated: 10/23/2026