Get started
Repository, intelligence, and policy concepts
Core repository, artifact, SBOM, finding, and policy terminology used throughout Smart Kubaba documentation.
Repository and artifact
Hosted repositories handle team publishing, proxy repositories handle upstream access and caching, and group repositories provide ordered resolution. An artifact is recorded with its file, package, version, and metadata relationships.
Intelligence and policy
OSV data provides vulnerability context, CycloneDX SBOMs provide component and dependency relationships, and policy produces a PASS, WARN, or BLOCK decision.
Scope and ownership
Organization, project, and repository scopes determine ownership for access, scans, policies, and audit records.
Scan, finding, and decision lifecycle
A CycloneDX SBOM is a scan input; components and dependency edges are normalized, OSV matches produce findings, and applicable policy produces the evaluation result. Later synchronization or policy changes create a new evaluation context rather than deleting historical results.
Tasks and operational records
Synchronization, scanning, cleanup, and storage transfer are long-running tasks. Task records track progress and failure; audit records track administrative change; Package Usage tracks package access; Operation and Outbound records support platform and external-connection investigation.
Data layers
PostgreSQL stores ownership, metadata, tasks, and record state. Artifact content resides in filesystem or S3-compatible storage. The presence of an object in storage alone does not create valid artifact metadata or grant access.