Container Registry and Software Supply Chain Platform  ·  View 13 of 33  ·  3 · Data

Component Index

How 'which images contain package X at version Y' stays a bounded query as the corpus grows.

Editable source SVG draw.io All views
Cataloguer Index key Partition Determination Advisory source OS packages Syft OS cataloguer pkg:deb · rpm · apk by ecosystem present only Distro feed + OSV Go modules Syft go-module pkg:golang ecosystem + prefix reachable call graph OSV Go npm Syft javascript pkg:npm ecosystem + scope reachable import graph OSV + GHSA Java Syft java-archive pkg:maven ecosystem + groupId present only phase 3 OSV + GHSA Python Syft python pkg:pypi ecosystem + prefix reachable import graph OSV PyPI Base layers Layer cataloguer layer digest by layer digest inherited fan out to derived same as OS row Component Index — Partitioning and Determination Application we own Data store Decision point External / third party Every row is rebuildable by replaying SBOM attestations. Full rebuild budget: 4 hours. v 1.0 · owner Data Architecture · date 2026-09

Answering question 4

  • Maintain the component index and match advisories against it — never rescan the corpus on a schedule
  • A new advisory touches roughly 120 of 40,000 artifacts; scan compute scales with that number, not with the corpus
  • Stored-but-not-running artifacts are still answered for, because audit asks about them

Partitioning

  • Partitioned by ecosystem and component-name prefix, so the query is bounded rather than a full scan
  • Base layers are indexed by layer digest, which is what makes base-image fan-out a single fact
  • Query budget: p95 ≤ 3 s across the full retained corpus

Honest limits

  • Reachability is available for Go, npm and Python; Java is present-only until phase 3, and the determination made is recorded per finding
  • CPE-to-purl mapping from NVD is lossy; disagreement between feeds is flagged rather than resolved automatically
◀  Supply Chain Data Flow All views Multi-Region Topology  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises13-component-index