Share an SBOM with a customer
This page reflects our reading of Cyber Resilience Act, Annex II(9) as of . It is not legal advice. Review process.
An OEM integrating your product often asks for its SBOM. Emailing the file leaves you no way to withdraw it or to know it was opened. A share link gives the customer a page under your disclosure page where they download the files, until it expires or you revoke it.
Each file is the SBOM exactly as you uploaded it, with the SHA-256 recorded at upload so the customer can check what they received.
Before you start
- A Growth or Partner plan.
- A published disclosure page. Links open under its address, so the form is hidden until it is published.
- A product with at least one supported version that has a parsed SBOM.
- A member, admin or owner role (
products.write) to create or revoke a link.
Steps
- Open the product, then Trust Center, then Share SBOMs.
- Enter the Recipient (the customer or integrator the link is for). The email is optional and is kept for your records only; nothing is sent to it.
- Set Expires after (days), from 1 to 180. A link cannot last longer.
- Tick the Versions to share, or leave all unticked to share every supported version, including ones added later.
- Press Create link.
- Copy the link at once. It is shown once. Declara stores a hash of the secret, not the link, so a lost link cannot be recovered, only replaced.
- Send it over a channel you trust. Anyone holding it can download until it expires.
What the recipient sees
The secret is in the part of the address after #, which the browser never sends to a
server. The page reads it, removes it from the address bar and exchanges it for the list
of versions. They see each version, its SBOM format and the SHA-256, with a Download
button. Only versions that are supported and have a parsed SBOM are offered.
Revoke a link
Press Revoke beside the link and confirm. It stops working at once, including in a tab the recipient already had open. A revoked or expired link shows a badge in the list.
The access log
Under Access log you see the latest 50 uses: when, which link, Opened, Downloaded or Refused, which version and the browser's user agent. The caller's address is never stored; only a salted hash, so two visitors can be told apart.
Each link also shows when it was last used and how many times.
What a refused attempt looks like
Every failure gets the same answer: This link is not valid. That covers an unknown secret, an expired or revoked link, a version outside the link, a product that is paused or archived, an unpublished disclosure page and a plan that no longer includes sharing. The page does not say which, so it cannot be used to find out which secrets exist.
A refused attempt on a link that exists is logged against it, so you can see that someone tried an old link. An attempt with a secret that matches no link has nothing to log against and is not recorded. Too many requests from one address get a "try again in a few minutes" message instead.