English | 简体中文
SBOM-TOOL is a ctl tool that generates software bill of materials (SBOM) for software projects through source code warehouse, code fingerprint, construction environment, artifact information, artifact content, dependency construction and other dimensional information.
language | Is it supported |
---|---|
C/C++ |
yes |
Java |
yes |
C# |
yes |
Dart |
yes |
Golang |
yes |
Javascript |
yes |
Objective-C |
yes |
Php |
yes |
Python |
yes |
Ruby |
yes |
Rust |
yes |
Swift |
yes |
Lua |
yes |
Configuration file parsing and binary package parsing related to the following programming languages are now supported, and more programming languages will be supported step by step.
Package Type | Package Manager | Parsing file | support dependency graph |
---|---|---|---|
maven |
Maven |
|
yes |
maven |
Gradle |
|
yes |
conan |
Conan |
|
yes |
npm |
NPM |
|
no |
npm |
Yarn |
|
yes |
npm |
PNPM |
|
yes |
golang |
Go Module |
|
yes |
golang |
Glide |
|
no |
golang |
GoDep |
|
no |
golang |
Dep |
|
no |
golang |
GVT |
|
no |
pypi |
PIP |
|
yes |
pypi |
Poetry |
|
yes |
conda |
Conda |
|
no |
composer |
Composer |
|
no |
cargo |
Cargo |
|
yes |
carthage |
Carthage |
|
no |
swift |
SwiftPM |
|
no |
cocoapods |
Cocoapods |
|
yes |
gem |
Gem |
|
yes |
nuget |
NuGet |
|
yes |
pub |
Pub |
|
yes |
rpm |
RPM |
|
no |
deb |
DEB |
|
no |
lua |
LuaRocks |
|
no |
bower |
Bower |
|
no |
go 1.18
or above is required)
git clone git@gitee.com:JD-opensource/sbom-tool.git
cd sbom-tool
make
Or install via go install
go install gitee.com/JD-opensource/sbom-tool/cmd/sbom-tool@latest
Or install via downloading the binary: SBOM-TOOL Releases
subcommand | function |
---|---|
help |
Help about any command |
artifact |
collect artifact information |
assembly |
assembly sbom document from document segments |
completion |
Generate the autocompletion script for the specified shell |
convert |
convert sbom document format |
env |
build environment info |
fingerprint |
generate code fingerprint |
generate |
generate sbom document |
package |
collect package dependencies |
source |
collect source code information |
validate |
validate sbom document format |
info |
get tool introduction information |
modify |
modify sbom document properties |
Parameters | Short parameter | describe | Use exampl |
---|---|---|---|
--log-level |
log level (debug 、info 、warn 、error ) |
--log-level info |
|
--log-path |
log output path (default "$home/sbom-tool/sbom-tool.log") | --log-path /tmp/sbom.log |
|
--quiet |
-q |
no console output |
--quiet -q
|
--ignore-dirs |
dirs to ignore, skip all dot dirs, split by comma. sample: node_modules,logs | --ignore-dirs log,logs |
|
--language |
-l |
programming language (Currently supported:java ,cpp )(Default “*”) |
--language java -l cpp
|
--parallelism |
-m |
number of parallelism(Default 8 ) |
--parallelism 4 -m 9
|
--output |
-o |
output file,The result file is produced in the current directory by default. | --output /tmp/sbom.json |
--src |
-s |
project source directory(use project root if empty) (default ".") | --src /tmp/sbomtool/src/ |
--path |
-p |
Specify the project project home directory; the assemble subcommand is used to specify the temporary document path for each phase | --path /tmp/sbomtool/ |
--dist |
-d |
distribution directory (default ".") | --dist /tmp/sbomtool/bin/ |
--format |
-f |
Specify SBOM document format(Currently supported:xspdx-json 、spdx-json 、spdx-tagvalue )(Default spdx-json ) |
--format xspdx-json -f spdx-json
|
--input |
-i |
Specify the SBOM document as input | --input /tmp/sbom.jsom |
specification | format | SBOM document format | status |
---|---|---|---|
XSPDX |
JSON |
xspdx-json |
Supported |
SPDX |
JSON |
spdx-json |
Supported |
SPDX |
TagValue |
spdx-tagvalue |
Supported |
Generate code fingerprints only based on the source code path
sbom-tool fingerprint -m 4 -s ${src_path} -o fingerprint.json --ignore-dirs .git
Generate an SBOM document and specify the format
sbom-tool generate -m 4 -p ${project_path} -s ${src_path} -d ${dist_path} -o sbom.spdx.json -f spdx-json --ignore-dirs .git -n ${name} -v ${version} -u ${supplier} -b ${namespace}
Get tool introduction information
sbom-tool info
See document for details.
See for details Development guide documentation
If you encounter problems in use, you are welcome to submit ISSUE to us.
SBOM-TOOL is a open source software component analysis tool, look forward to your contribution.
This project is licensed under MulanPSL2 - see the LICENSE file for details.
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。
1. Open source ecosystem
2. Collaboration, People, Software
3. Evaluation model