This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Attaching Analysis Bundle Assets

An analysis bundle is a portable tar archive produced by anchorectl generate analysis-bundle, capturing the result of a local analysis so it can be attached to an app version later, from a different host, network, or pipeline stage. Producing a bundle is covered in Generating SBOMs; this page covers attaching one.

Two bundle types exist, matching the two locally analyzed asset paths:

  • Container image bundles — carry the full analysis document set: the SBOM plus the image manifest, image config, and any secret search, content search, and retrieved-file results.
  • Filesystem bundles — carry the SBOM generated from a local directory tree.

Upload an Analysis Bundle with AnchoreCTL

Attach a bundle of either type with app version asset add analysis-bundle. The bundle path is the positional argument; the parent app, version, and asset name are required:

anchorectl app version asset add analysis-bundle api-image-1.4.0.tar \
  --app my-service \
  --version 1.4.0 \
  --asset api-image

The two bundle types behave slightly differently at upload:

  • Image bundles are validated locally before anything is sent (every expected document present and well formed), and the image reference is recovered from the SBOM inside the bundle, so the image is never re-pulled. The asset type defaults to container.
  • Filesystem bundles upload the contained SBOM. Set --type filesystem so the asset is typed correctly in the version’s asset list.

The shared asset-add flags apply here too: --annotations attaches build metadata at create time (see Managing Assets in an App Version for the merge and clear semantics), and --wait blocks until the job reaches a terminal state, which is useful when a CI stage should gate on the outcome:

anchorectl app version asset add analysis-bundle cli-binary-1.4.0.tar \
  --app my-service \
  --version 1.4.0 \
  --asset cli-binary \
  --type filesystem \
  --annotations "owner=platform-team,commit=a3f7c01" \
  --wait

Add an Analysis Bundle with the API

There is no separate bundle job type. AnchoreCTL unpacks the bundle client-side and routes its contents to the same App Jobs endpoints used by direct analysis:

  • Image bundles → POST /apps/{app_id}/jobs/add-imported-image-asset, the same multipart payload as distributed image analysis: the SBOM together with the image manifest, image config, and any optional analysis artifacts.
  • Filesystem bundles → POST /apps/{app_id}/jobs/add-sbom-asset, the same job used for any externally produced SBOM.

The full request and response schemas are in the API browser; search for the App Jobs tag.

A few conventions worth knowing as you call these endpoints:

  • The job response carries a job_id; poll GET /apps/{app_id}/jobs/{job_id} to track status. Job state transitions are documented in How It Works.
  • Cross-account requests are scoped via the x-anchore-account header or, from AnchoreCTL, the ANCHORECTL_ACCOUNT environment variable. See Account Scoping for the full mechanism.