From fd8d3ae172c2721548c55f2036cb61155d2b2cc7 Mon Sep 17 00:00:00 2001
From: Henry Mitchell-Hibbert <henrymh@google.com>
Date: Thu, 15 Oct 2026 00:03:50 +0000
Subject: [PATCH 1/2] Make FetchSBOM and FetchVEX stream single files in chunks

---
 proto/securityservices.proto | 46 +++++++++++++++++++-----------------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/proto/securityservices.proto b/proto/securityservices.proto
index 22f0bad..6d9bc6d 100644
--- a/proto/securityservices.proto
+++ b/proto/securityservices.proto
@@ -258,32 +258,22 @@ message ImageIdentifier {
   message AllHardwareModels {}
 }
 
-// An SbomArtifact represents a SBOM document.
-message SbomArtifact {
+// Metadata describing a streamed SBOM document.
+message SbomArtifactMetadata {
   // The image identifier associated with this SBOM payload.
   ImageIdentifier identifier = 1;
 
   // The underlying SBOM specification standard.
   SbomDocumentStandard standard = 2;
-
-  // A fully formed JWS in standard JSON Serialization format (Flattened).
-  // The raw SBOM statement is Base64url-encoded and embedded within the "payload" field of this JSON object.  JWS JSON Serialization Spec:
-  // https://datatracker.ietf.org/doc/html/rfc7515#section-7.2
-  string jws_json = 3;
 }
 
-// A VexArtifact represents a VEX document.
-message VexArtifact {
+// Metadata describing a streamed VEX document.
+message VexArtifactMetadata {
   // The image identifier associated with this VEX payload.
   ImageIdentifier identifier = 1;
 
   // The underlying VEX specification standard.
   VexDocumentStandard standard = 2;
-
-  // A fully formed JWS in standard JSON Serialization format (Flattened).
-  // The raw VEX statement is Base64url-encoded and embedded within the "payload" field of this JSON object.  JWS JSON Serialization Spec:
-  // https://datatracker.ietf.org/doc/html/rfc7515#section-7.2
-  string jws_json = 3;
 }
 
 // Metadata about the artifact.
@@ -328,23 +318,35 @@ message ListInventoryResponse {
 // --- Messages for SBOM Data Retrieval ---
 
 message FetchSBOMRequest {
-  // Identifiers for which Software Bill of Materials are requested.
-  repeated ImageIdentifier identifiers = 1;
+  // Identifier of the requested SBOM document.
+  ImageIdentifier identifier = 1;
 }
 
 message FetchSBOMResponse {
-  repeated SbomArtifact artifacts = 1;
+  oneof payload {
+    // Sent in the first message of the stream to describe the artifact.
+    SbomArtifactMetadata metadata = 1;
+
+    // Sequential chunk of the signed SBOM JSON document.
+    bytes chunk = 2;
+  }
 }
 
 // --- Messages for VEX Data Retrieval ---
 
 message FetchVEXRequest {
-  // Identifiers for which VEXs are requested.
-  repeated ImageIdentifier identifiers = 1;
+  // Identifier of the requested VEX document.
+  ImageIdentifier identifier = 1;
 }
 
 message FetchVEXResponse {
-  repeated VexArtifact artifacts = 1;
+  oneof payload {
+    // Sent in the first message of the stream to describe the artifact.
+    VexArtifactMetadata metadata = 1;
+
+    // Sequential chunk of the signed VEX JSON document.
+    bytes chunk = 2;
+  }
 }
 
 
@@ -372,9 +374,9 @@ service SecurityService {
    // Lists all available artifacts.
    rpc ListInventory(ListInventoryRequest) returns (ListInventoryResponse);
 
-   // Streams the SBOM for target artifact(s) to handle large file sizes.
+   // Streams the SBOM for a target artifact to handle large file sizes.
    rpc FetchSBOM(FetchSBOMRequest) returns (stream FetchSBOMResponse);
 
-   // Streams the VEX for target artifact(s) to handle large file sizes.
+   // Streams the VEX for a target artifact to handle large file sizes.
    rpc FetchVEX(FetchVEXRequest) returns (stream FetchVEXResponse);
 }

From de36d4a4f90dc9cf8d2b53ff07786d99741080e7 Mon Sep 17 00:00:00 2001
From: Henry Mitchell-Hibbert <henrymh@google.com>
Date: Tue, 20 Oct 2026 05:07:09 +0000
Subject: [PATCH 2/2] Add size_bytes to artifact metadata protos, add chunk
 size recommendations

---
 proto/securityservices.proto | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/proto/securityservices.proto b/proto/securityservices.proto
index 6d9bc6d..93ff279 100644
--- a/proto/securityservices.proto
+++ b/proto/securityservices.proto
@@ -265,6 +265,9 @@ message SbomArtifactMetadata {
 
   // The underlying SBOM specification standard.
   SbomDocumentStandard standard = 2;
+
+  // The size of the SBOM document in bytes.
+  int64 size_bytes = 3;
 }
 
 // Metadata describing a streamed VEX document.
@@ -274,6 +277,9 @@ message VexArtifactMetadata {
 
   // The underlying VEX specification standard.
   VexDocumentStandard standard = 2;
+
+  // The size of the VEX document in bytes.
+  int64 size_bytes = 3;
 }
 
 // Metadata about the artifact.
@@ -328,6 +334,7 @@ message FetchSBOMResponse {
     SbomArtifactMetadata metadata = 1;
 
     // Sequential chunk of the signed SBOM JSON document.
+    // It's recommended to use a chunk size between 16 and 64KiB.
     bytes chunk = 2;
   }
 }