Software Bill of Materials

Aegix maintains a Software Bill of Materials (SBOM) for the software components that make up the Aegix platform. This page describes what we produce, how it is protected, and how to obtain it.

1. WHAT WE PRODUCE

Aegix generates an SBOM in CycloneDX format for each build artifact it ships, produced automatically as part of the build rather than compiled by hand after the fact. Each SBOM is generated from the artifact itself, so it reflects what was actually built and released.

SBOMs are retained alongside our other compliance evidence under the same retention controls, so an SBOM can be produced for a given release after the fact rather than only at the time of shipping.

2. INTEGRITY AND PROVENANCE

Build artifacts and their SBOMs are cryptographically signed using keyless signing through the Sigstore public-good infrastructure. Signing certificates are issued by Fulcio and signing events are recorded in the Rekor public transparency log, which allows a recipient to verify independently that an artifact and its SBOM were produced by our build pipeline.

Signature and certificate material is retained alongside each SBOM so that the two can be verified together.

3. KNOWN LIMITS

We state the limits of this evidence rather than presenting it as complete.

An SBOM describes the components a build declares and resolves. Some software distribution formats embed or relocate third-party code in ways that do not appear as distinct components in any generated SBOM. Where that applies to an Aegix artifact, we treat it as a known limit of the evidence and account for it in vulnerability triage rather than relying on component coordinates alone.

4. HOW TO REQUEST AN SBOM

Aegix does not publish raw SBOMs publicly. They are made available to customers and prospective customers under a non-disclosure agreement, and to auditors and assessors as part of a compliance review.

To request an SBOM for a specific release, contact security@aegix.global. Please identify the product and release you need. Requests from customers under an existing agreement are handled through your usual Aegix contact.

5. RELATED

Our vulnerability handling process, including how we triage and remediate issues found in third-party components, is described in the Vulnerability Disclosure Policy.