The value of an inventory is entirely in query time, and a set of JSON files nobody can search is a compliance artefact rather than a tool.
# the question, at 22:00 on a Thursday
$ ./bin/sbom-query 'log4j'
no match in 41 images across 3 environments
$ ./bin/sbom-query 'guzzlehttp/guzzle' --lt 7.4.5
app-api 7.4.1 production deployed 2021-11-02
app-worker 7.4.1 production deployed 2021-11-02
app-admin 7.4.5 staging
# eleven hours the first time. four minutes the second.The version comparison is the part that has to work, because “do we use this package” is rarely the question — “are we below the fixed version” is. Answering across environments matters too, since staging being patched says nothing. A rehearsal against a known advisory, timed with a stopwatch, is worth doing once a quarter: the query script rots exactly like everything else and nobody notices until it is needed.