Description

• Refactors SBOMer out of matcherImpl and into matcherService to allow better injection of the repository-to-cpe dependency (i.e., we need the indexer that's passed in to matcherService).
• Adds the ScanSBOM API to the scanner v4 matcher service.
• Adds ScanSBOM to the scanner v4 client.

PR stack:

• master
  • ROX-30569: Add SBOM Scanning REST API to Central #18484
    • ROX-32846: Add repository-to-CPE mapping API to indexer #18705
      • ROX-30588: Update claircore #18710
        • 👉 ROX-30570: Add ScanSBOM API to Scanner V4 #18716

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

No automated testing. Will follow up in ROX-27690.

How I validated my change

1. Deploy stackrox
2. Set the ROX_SBOM_SCANNING feature flag:

   ❯ kubectl set env deploy/central ROX_SBOM_SCANNING=true
   ❯ kubectl set env deploy/scanner-v4-indexer ROX_SBOM_SCANNING=true
   

Matcher API

1. Port forward Matcher

   ❯ kubectl port-forward svc/scanner-v4-indexer 8443
   

2. Hit the endpoint using a test file from sbom/spdx: add SPDX decoder quay/claircore#1745

   ❯ jq -n --rawfile sbom /Users/blugo/dev/quay/claircore/work/sbom/spdx/testdata/decoder/konflux-syft+hermeto.spdx.json \
     '{sbom: ($sbom | @base64), media_type: "application/spdx+json"}' | \
       grpcurl -insecure \
         -import-path proto \
         -proto internalapi/scanner/v4/matcher_service.proto \
         -d @ \
         localhost:8443 scanner.v4.Matcher/ScanSBOM | head
   "vulnerabilityReport": {
     "vulnerabilities": {
       "554938": {
         "id": "554938",
         "name": "CVE-2025-66471",
         "description": "urllib3 streaming API improperly handles highly compressed data",
         "issued": "2025-12-05T18:15:54Z",
         "link": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37 https://nvd.nist.gov/v
         "severity": "HIGH",
         "normalizedSeverity": "SEVERITY_IMPORTANT",
         "fixedInVersion": "2.6.0",
         "cvss": {
           "v3": {
             "baseScore": 7.5,
             "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
           },
           "source": "SOURCE_NVD",
           "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
         },
         "cvssMetrics": [
           {
             "v3": {
               "baseScore": 7.5,
               "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
   
   

scanner v4 client

Replicate the validation from #18484:

❯ curl -ski -X POST \
    -H "Content-Type: application/spdx+json" \
    -H "Authorization: Bearer $ROX_API_TOKEN" \
    --data-binary @/Users/blugo/dev/quay/claircore/work/sbom/spdx/testdata/decoder/konflux-syft+hermeto.spdx.json
    $ROX_ENDPOINT/api/v1/sboms/scan | head -n 30
content-type: application/json
vary: Accept-Encoding
date: Wed, 28 Jan 2026 06:32:41 GMT

{
  "scan": {
    "scannerVersion": "matcher=4.10.x-883-gf97aa6fc7a-dirty",
    "scanTime": "2026-01-28T06:32:41.166793266Z",
    "components": [
      {
        "name": "psmisc",
        "version": "23.4-3.el9",
        "architecture": "s390x"
      },
      {
        "name": "libsepol",
        "version": "3.6-3.el9",
        "architecture": "aarch64"
      },
      {
        "name": "gawk",
        "version": "5.1.0-6.el9",
        "architecture": "src"
      },
      {
        "name": "json-glib",
        "version": "1.6.6-1.el9",
        "architecture": "src"
      },