Rocheston ZelSafe · Official Release SBOM

ZPD Software Bill of Materials

Complete software-supply-chain evidence package for the official ZelSafe Private Dashboard Docker release: component inventory, machine-readable SBOMs, release provenance, vulnerability evidence, license notices, checksums, and federal review support.

1.0.0Product version

44SBOM components

0Trivy findings

linux/amd64Target platform

DockerRuntime package

ZDRNo employee data included

Official release package generated from the final published Docker image digest. No employee data is included.

What This SBOM Proves

A Software Bill of Materials is the ingredient list for the ZelSafe Private Dashboard release. It lets security teams, procurement reviewers, government agencies, and compliance auditors see exactly what software components are included, which licenses apply, which container image was scanned, and whether known vulnerabilities were detected at release time.

Download Complete SBOM PackageIncludes CycloneDX, SPDX, component inventory, vulnerability evidence, provenance, checksums, and third-party notices.Read ZPD DocumentationReturn to the ZelSafe Private Dashboard documentation page.

Current Release

Product

ZelSafe Private Dashboard

Vendor

Rocheston

Product Version

1.0.0

Release Status

OFFICIAL RELEASE SBOM

Container Image

rocheston/zpd:1.0.0

Image Digest

sha256:5bf83090f2fe3c621403f33a71fbbdcae73b7672ed37e4a5332990bc4a440c4e

Platform Manifest Digest

sha256:2e6df6caffb16803cff46cd8750789c4eb98b7069a3a7abacbaaeaae7391e890

Base Image

php:8.3-cli-alpine

Base Image Digest

sha256:2ca4d56e7a16690dc7f04e201dedc96acf25398e00953e8381fd55ecf08cc5c3

Target Architecture

linux/amd64

SBOM Generated

2026-07-29T08:56:18Z

SBOM Author

Rocheston

SBOM Generator

Trivy

Generation Context

final-docker-image

Coverage

This SBOM covers the final ZPD Docker image, Alpine operating-system packages, PHP runtime, PHP extensions, SQLite/OpenSSL-linked runtime packages, and bundled application assets detected in the container image.

Download Center

Complete Government Supply-Chain PackageSBOM, component inventory, licenses, vulnerability evidence, provenance, checksums, and supporting release artifacts.CycloneDX JSONzpd.cdx.json SPDX JSONzpd.spdx.json Component CSVzpd-components.csv Component Inventory PDFzpd-component-inventory.pdf Third-Party NoticesTHIRD_PARTY_NOTICES.txt Trivy Vulnerability Scan JSONzpd-vulnerability-scan.json Docker Scout Reportzpd-scout-vulnerability-report.md Docker Scout SBOMzpd-scout-sbom.json Build Provenance JSONzpd-provenance.json Release File Integrity ManifestZPD-Release-File-Integrity-Manifest.json SHA-256 ChecksumsSHA256SUMS

SBOM Integrity

Published hashes verify each downloadable artifact after download.

SHA-256	Artifact
247c8ae16980fb0616ef2926cffd67d572e6681a5158f6bdba786c522b5fa8c3	README-SBOM.txt
510b043032b3073445de9b3a04c3641db3955c3fe26ded9400d08b75b40136b2	zpd.cdx.json
70da44256f7c411fb20ba9c9bd938fbaea5287d3a0b80da04b3341e3bbf77ea1	zpd.spdx.json
7defbffc2e4295eac643832a773eca0677ff88eb7d6b6bf05aad020dacd443b1	zpd-components.csv
56c09587a134f2d3b2cfce75cbed15cb7e7a2c6eb9d3c5d799339c3ef4bd860d	zpd-component-inventory.pdf
b7ad35691c828bf048c37ed3962b3aba132f49e1973dadc6263c79cdac66e119	zpd-vulnerability-scan.json
eb98558573de4c2be347e152826d1eb9612cd7bf487c0d319853f6b63da039f3	zpd-scout-vulnerability-report.md
65ad68fabaf0c5bb0185886df938c44b397a3dbf97ab034845303922fd5c46d7	zpd-scout-sbom.json
17338c6c7185059e9ea15377027be1e52bfe29a3895e700f94e15a5f44897e47	zpd-provenance.json
ff03c85e2c5eecdda66cb40f239d97bc4ad291e3ab8217bacb90462466223fff	THIRD_PARTY_NOTICES.txt
71b163ab0635b192a3ee9402c37c3382123e909c91af0eb4757aa82a64529752	release-manifest.json
2dcaf8b947f66dd874f6e9d6f5878363a7d35a7caf8619833d2a4c63dc0bb3d7	ZPD-Release-File-Integrity-Manifest.json

Minimum Elements Alignment

Informational validation against commonly expected federal software-component metadata.

Element	Result	Evidence
SBOM Author	AVAILABLE	Rocheston
Software Producer	AVAILABLE	Rocheston
Component Name	AVAILABLE	44 components
Component Version	AVAILABLE	Component CSV / CycloneDX
Software Identifier	AVAILABLE	Package URLs when detected
Component Hash	PARTIAL	Published artifact hashes and detected package hashes when available
License	AVAILABLE	License fields from SBOM
Dependency Relationship	PARTIAL	Container package inventory with included components
Timestamp	AVAILABLE	2026-07-29T08:56:18Z
Generator Tool	AVAILABLE	Trivy
Generation Context	AVAILABLE	final-docker-image
Coverage Declaration	AVAILABLE	This SBOM covers the final ZPD Docker image, Alpine operating-system packages, PHP runtime, PHP extensions, SQLite/OpenSSL-linked runtime packages, and bundled application assets detected in the container image.
Known Unknowns Declaration	AVAILABLE	Release signature and source archive hash are not provided in this package.

Software Component Inventory

Component	Type	Version	Package URL	License	Source	Status
alpine	operating-system	3.24.1	UNKNOWN	UNKNOWN	container image	NO FINDINGS DETECTED BY TRIVY
acl-libs	library	2.3.2-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	LGPL-2.1-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
alpine-baselayout-data	library	3.7.2-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
alpine-baselayout	library	3.7.2-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
alpine-keys	library	2.6-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
alpine-release	library	3.24.1-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
apk-tools	library	3.0.7-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
argon2-libs	library	20190702-r5	pkg:apk/alpine/argon2-libs@20190702-r5?arch=x86_64&distro=3.24.1	Apache-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
brotli-libs	library	1.2.0-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
busybox-binsh	library	1.37.0-r31	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
busybox	library	1.37.0-r31	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
c-ares	library	1.34.8-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
ca-certificates-bundle	library	20260611-r0	pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1	MPL-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
ca-certificates	library	20260611-r0	pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1	MPL-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
curl	library	8.21.0-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	curl	alpine	NO FINDINGS DETECTED BY TRIVY
gnu-libiconv-libs	library	1.18-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	LGPL-2.1-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
libapk	library	3.0.7-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
libbz2	library	1.0.8-r6	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	bzip-2-1.0.6	alpine	NO FINDINGS DETECTED BY TRIVY
libcrypto3	library	3.5.7-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	Apache-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
libcurl	library	8.21.0-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	curl	alpine	NO FINDINGS DETECTED BY TRIVY
libgcc	library	15.2.0-r5	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
libidn2	library	2.3.8-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
libncursesw	library	6.6_p20260516-r0	pkg:apk/alpine/[email protected]_p20260516-r0?arch=x86_64&distro=3.24.1	X-11	alpine	NO FINDINGS DETECTED BY TRIVY
libpsl	library	0.21.5-r3	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
libsodium	library	1.0.22-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	ISC	alpine	NO FINDINGS DETECTED BY TRIVY
libssl3	library	3.5.7-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	Apache-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
libunistring	library	1.4.2-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
libxml2	library	2.13.9-r2	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
libzip	library	1.11.4-r2	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	BSD-3-Clause	alpine	NO FINDINGS DETECTED BY TRIVY
musl-utils	library	1.2.6-r2	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
musl	library	1.2.6-r2	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
ncurses-terminfo-base	library	6.6_p20260516-r0	pkg:apk/alpine/[email protected]_p20260516-r0?arch=x86_64&distro=3.24.1	X-11	alpine	NO FINDINGS DETECTED BY TRIVY
nghttp2-libs	library	1.69.0-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	MIT	alpine	NO FINDINGS DETECTED BY TRIVY
oniguruma	library	6.9.10-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	BSD-2-Clause	alpine	NO FINDINGS DETECTED BY TRIVY
openssl	library	3.5.7-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	Apache-2.0	alpine	NO FINDINGS DETECTED BY TRIVY
readline	library	8.3.3-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-3.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
scanelf	library	1.3.9-r1	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
sqlite-libs	library	3.53.2-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	blessing	alpine	NO FINDINGS DETECTED BY TRIVY
ssl_client	library	1.37.0-r31	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-only	alpine	NO FINDINGS DETECTED BY TRIVY
tar	library	1.35-r5	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-3.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
xz-libs	library	5.8.3-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
xz	library	5.8.3-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	GPL-2.0-or-later	alpine	NO FINDINGS DETECTED BY TRIVY
zlib	library	1.3.2-r0	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	Zlib	alpine	NO FINDINGS DETECTED BY TRIVY
zstd-libs	library	1.5.7-r2	pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.24.1	BSD-3-Clause	alpine	NO FINDINGS DETECTED BY TRIVY

Showing full inventory: 44 components.

Dependency Relationships

ZelSafe Private Dashboard ├── PHP Runtime ├── Alpine Linux base image ├── SQLite / PDO SQLite ├── OpenSSL-linked runtime packages ├── Zip extension / libzip ├── Local web assets └── Operating-system packages from final Docker image

Licenses and Notices

License Summary

Unique Licenses

Known License Components

Unknown License Components

License Sources

CycloneDX, SPDX, component CSV

Notices File

THIRD_PARTY_NOTICES.txt

Third-Party Notices

Download the notices file for distributed third-party runtime packages and bundled assets. Unknown licenses are declared as UNKNOWN rather than guessed.

Download notices

Vendor Release Vulnerability Status

0CriticalImmediate release blocker

0HighPriority remediation

0MediumTracked review item

0LowInformational risk

PASSTrivy ScanNo critical/high/medium/low findings

Scanner

Trivy

Scan Status

Critical 0High 0Medium 0Low 0Trivy pass

Critical Findings

High Findings

Medium Findings

Low Findings

Total CRITICAL/HIGH/MEDIUM/LOW

Scanned Image

rocheston/zpd:latest

Scanned Digest

sha256:5bf83090f2fe3c621403f33a71fbbdcae73b7672ed37e4a5332990bc4a440c4e

VEX Status

VEX NOT PROVIDED

Scanner databases and severity classification can differ. This page includes Trivy JSON and a separate Docker Scout report.

ID	Component	Installed	Severity	Fixed Version	Status
No CRITICAL/HIGH/MEDIUM/LOW findings detected by Trivy

Build Provenance

product name

ZelSafe Private Dashboard

product version

1.0.0

source repository

rocheston/zpd

source revision

official-docker-release-1.0.0

source archive sha256

NOT PROVIDED

build timestamp

2026-07-29T08:56:18Z

build platform

Docker Buildx

build architecture

linux/amd64

builder identifier

Rocheston release build

container image

rocheston/zpd:1.0.0

container image digest

sha256:5bf83090f2fe3c621403f33a71fbbdcae73b7672ed37e4a5332990bc4a440c4e

platform manifest digest

sha256:2e6df6caffb16803cff46cd8750789c4eb98b7069a3a7abacbaaeaae7391e890

base image

php:8.3-cli-alpine

sbom generator

Trivy

vulnerability scanner

Trivy

signature status

SIGNATURE NOT PROVIDED

Current Deployment Inventory

The vendor release SBOM describes the software supplied by Rocheston. Customer deployment inventory depends on where the container is run. ZPD is intended to run on customer-controlled infrastructure with a private persistent storage volume.

Runtime Environment

Docker / OCI container

Persistent Data Location

/var/lib/zpd/storage

External Runtime Calls

None required by ZPD application runtime

Employee Data Included In SBOM

Federal Evidence Relevance

Evidence Area	ZPD Artifact	Relevance
Software Component Transparency	CycloneDX / SPDX SBOM	Machine-readable inventory
System Component Inventory Support	Component CSV and Docker image metadata	Supports CM-8 style inventory review
License Inventory	Third-party notices and SBOM license fields	Supports procurement and legal review
Release Integrity	SHA256SUMS	Artifact integrity verification
Build Traceability	Provenance JSON	Release metadata and image digest linkage
Known Vulnerabilities	Trivy JSON / Docker Scout Markdown	Vulnerability-management evidence
Container Traceability	Image digest and platform manifest digest	Exact release artifact identification

These artifacts support customer security reviews and federal software-supply-chain documentation. They do not independently constitute FedRAMP authorization, an Authority to Operate, or a complete system inventory for the customer’s authorization boundary.

Privacy and Scope

ZPD follows a zero-vendor-data model. The SBOM package concerns ZPD software components only. It contains no employee names, emails, certificates, scores, training records, upload PINs, administrator passwords, SQLite database files, or RCCS audit JSON evidence records.