{"record":{"id":"712d63a6933a39ea","repo":"goharbor/harbor","slug":"not-found-712d63","errorCode":"NOT_FOUND","errorMessage":"The sbom is not found","messagePattern":"The sbom is not found","errorType":"http","errorClass":"lib/errors.Error","httpStatus":404,"severity":"error","filePath":"src/controller/artifact/processor/sbom/sbom.go","lineNumber":68,"sourceCode":"}\n\n// AbstractAddition returns the addition for SBOM\nfunc (m *Processor) AbstractAddition(_ context.Context, art *artifact.Artifact, _ string) (*processor.Addition, error) {\n\tman, _, err := m.RegCli.PullManifest(art.RepositoryName, art.Digest)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to pull manifest\")\n\t}\n\t_, payload, err := man.Payload()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to get payload\")\n\t}\n\tmanifest := &v1.Manifest{}\n\tif err := json.Unmarshal(payload, manifest); err != nil {\n\t\treturn nil, err\n\t}\n\t// SBOM artifact should only have one layer\n\tif len(manifest.Layers) != 1 {\n\t\treturn nil, errors.New(nil).WithCode(errors.NotFoundCode).WithMessage(\"The sbom is not found\")\n\t}\n\tlayerDgst := manifest.Layers[0].Digest.String()\n\t_, blob, err := m.RegCli.PullBlob(art.RepositoryName, layerDgst)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to pull the blob\")\n\t}\n\tdefer blob.Close()\n\tcontent, err := io.ReadAll(blob)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &processor.Addition{\n\t\tContent:     content,\n\t\tContentType: processorMediaType,\n\t}, nil\n}\n\n// GetArtifactType the artifact type is used to display the artifact type in the UI","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/controller/artifact/processor/sbom/sbom.go#L50-L86","documentation":"The SBOM processor serves Harbor's internal SBOM attachment media type application/vnd.goharbor.harbor.sbom.v1. AbstractAddition pulls the artifact's own manifest and requires exactly one layer; a manifest with zero or multiple layers returns NotFound 'The sbom is not found', signaling that the SBOM attachment is missing or malformed.","triggerScenarios":"Requesting the SBOM addition when the referenced attachment artifact's manifest has no layers (manifest-only push) or more than one (assembled incorrectly); interrupted attachment pushes leave empty manifests.","commonSituations":"Trivy/Harbor SBOM attachments partially pushed after a job interruption, attachments created with the wrong layer layout, hand-pushed SBOM artifacts with extra layers.","solutions":["Delete the malformed SBOM attachment artifact and rescan the parent so the attachment is regenerated","Inspect the attachment manifest via the registry API (GET by digest) and count layers","If producing attachments yourself, push exactly one layer containing the SBOM content"],"exampleFix":"# before: attachment manifest has 0 layers (interrupted push) -> 'The sbom is not found'\n# after: remove and regenerate\ncurl -X DELETE .../artifacts/sha256:<sbom-attachment-digest>\n# then rescan the parent artifact so Trivy re-attaches a single-layer SBOM","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"content, err := sbomProc.AbstractAddition(ctx, art, \"sbom\")\nif err != nil {\n    if errors.IsErr(err, errors.NotFoundCode) && strings.Contains(err.Error(), \"sbom is not found\") {\n        // attachment malformed/missing: delete it and rescan the parent artifact\n    }\n    return err\n}","preventionTips":["Rescan the parent artifact to regenerate SBOM attachments after job interruptions","Verify attachments have exactly one layer before relying on them","Treat NotFound from the sbom addition as 'regenerate', not 'fatal'"],"tags":["go","harbor","sbom","additions","not-found","trivy"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}