SBOM and VEX Downloads

Security Assurance · Security Assessments · CRA and CE Marking

ServiceStack's security bundles provide machine-readable software inventories and supporting evidence for identified NuGet releases. Downloading these files does not require a ServiceStack subscription.

Download a release bundle​

Open the ServiceStack GitHub releases, select the release matching your packages, and expand Assets. When generation has completed successfully, the release includes:

• servicestack-security-<version>.zip
• servicestack-security-<version>.zip.sha256

A release tag such as v10.4 maps to NuGet version 10.4.0. A patch tag such as v10.4.2 maps to 10.4.2.

Verified download: 10.4.2​

The following files were verified on 12 November 2026:

• Download the 10.4.2 security ZIP
• Download its SHA-256 checksum
• View the originating security workflow

This bundle contains 49 package release records, all for 10.4.2. Its provenance identifies the exact published NuGet archives as the source and the dependency graph as a consumer baseline resolved at generation time.

Security generation runs separately after NuGet Pack. NuGet Publish waits for matching evidence, verifies it against the packed archives, and retains it after publishing. A subsequent attachment job prepares the public ZIP and attaches it to the matching release, or creates a versioned draft with the assets ready. Release publication and manual reattachment reuse that evidence without waiting for NuGet indexing. A published package or release does not by itself establish that attachment has completed successfully. If an asset is absent or its generation failed, there is no matching published bundle at that location yet. Check release-security workflow results; do not substitute a different release's inventory.

What is in the ZIP?​

The archive preserves the source-project folder layout. Start with the files at its root:

Each package has a security/releases/<version>/ folder containing:

Framework-specific graph references distinguish dependency applicability within the combined SBOM. Repeated NuGet package identities across frameworks are intentional. Native payload hashes are inventoried where present; a hash alone does not establish the embedded engine version or its vulnerability status.

Verify integrity​

Download the ZIP and checksum into the same folder. On Linux:

sha256sum -c servicestack-security-10.4.2.zip.sha256
unzip servicestack-security-10.4.2.zip -d servicestack-security-10.4.2
cd servicestack-security-10.4.2
sha256sum -c SHA256SUMS

On macOS, use shasum -a 256 -c in place of sha256sum -c. On Windows, compare Get-FileHash <zip-path> -Algorithm SHA256 with the published checksum.

The per-package manifest also identifies the original .nupkg hash, allowing you to compare the inventory with the package you obtained. Checksums detect content changes; they are not a digital signature or independent security attestation.

VEX information​

VEX describes an assessed vulnerability's impact on specified product versions and framework variants. ServiceStack renders dated CycloneDX VEX snapshots only when vulnerability-specific reviewed decisions are available. These can identify an affected, fixed, under-investigation or justified not-affected state.

The absence of VEX means no reviewed statements are included; it does not mean the product has no vulnerabilities. The verified 10.4.2 public bundle contains no VEX snapshots. Do not infer a not-affected decision from an empty decisions list or a scanner returning no matches.

Where a release contains several VEX snapshots, use the most recent applicable assessment and retain the earlier snapshots for history. Read the advisory, affected references, analysis, justification and remediation guidance together. A statement about one release or framework is not a statement about all ServiceStack products or all downstream configurations.

There is no blanket commitment on this page to publish VEX with every release or to maintain an unspecified LTS branch. Applicability depends on the vulnerability assessment and the supported product/version concerned.

Advisory observations and downstream scope​

audit.json is a point-in-time observation from NuGet advisory data, not a continuously updated all-clear. The scheduled security workflow rescans retained release graphs against current advisory data and preserves observations, including findings. Historical graphs can gain new advisory matches without their original SBOM changing.

Customers should scan their own application's resolved dependency graph and track .NET, operating-system, container and native-engine advisories separately. These package observations do not assess all first-party ServiceStack code or every deployment configuration.

Build and pre-release evidence​

For evidence associated with a particular package build, open its linked Package Security Evidence workflow run. Its Artifacts section can include:

• ServiceStack Security — the evidence tree;
• ServiceStack Security ZIP — a compressed bundle and checksum.

Use source-run.json to match the security output to its originating pack run and commit, and the manifests to match the actual NuGet archives. GitHub Actions artifact downloads require GitHub sign-in and are retained for 90 days. Public release assets provide the direct download route for released evidence. SBOMs are distributed separately; they are not currently embedded inside the .nupkg downloaded from NuGet or MyGet.

Reattaching a release ZIP reuses the retained publication evidence; it does not rerun dependency resolution or perform a new vulnerability assessment. Regenerating source evidence or adding reviewed VEX is a separate operation. Earlier release bundles may have been generated directly from NuGet, as their provenance states. Record the download date, checksum and provenance when retaining evidence for your own review. Actions retention still applies: if the original publication evidence has expired or is unavailable, reattachment fails explicitly rather than substituting another version or a fresh graph.