feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM#3983
feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM#3983candrews wants to merge 1 commit intosnyk:masterfrom
Conversation
f2a12f5 to
25a6052
Compare
|
During our call on Monday, October 1, Snyk expressed interest in having the SBOM generation command be "snyk sbom" instead of "snyk deps" . I personally like "snyk deps" more, but I'd also be happy with any name :) Therefore, I've updated ths pull request with a commit that just changes the command name from "deps" to "sbom" with no other changes. |
7b102b1 to
54690c9
Compare
|
hello everyone, if the upgrade to TypeScript 4.8 (via #3875) was an issue, |
|
Regardless of what Snyk does with this request, I think it would be greatly beneficial to users of the CycloneDX library to publish these compatible type definitions to enhance its utility for other projects so I opened the issue at CycloneDX/cyclonedx-javascript-library#291 |
|
Snyk itself advises keeping dependencies up to date. So regardless of what Snyk wants to do with this request, I hope they will upgrade their Typescript dependency. I'm more than happy to work with Snyk to do with upgrade at #3875 if they would work with me. |
package-lock.json
Outdated
There was a problem hiding this comment.
this is an optional depedency, that causes transitive dependnecies to install.
if you do not serialize to XML, then you could omit this optional dependency when adding @cyclonedx/cyclonedx-library as a dependency. see https://docs.npmjs.com/cli/v8/commands/npm-install#omit
from this PR it appears that the XML functionality is not used.
src/cli/commands/sbom/index.ts
Outdated
package-lock.json
Outdated
There was a problem hiding this comment.
this is the optional dep from https://github.com/snyk/cli/pull/3983/files#r1004854642
93e8a91 to
56ba629
Compare
|
|
The SBOM includes the dependencies and the dependency graph. The SBOM is generated entirely client side; it does not communicate with the Snyk server/API. See: https://cyclonedx.org/ Closes: https://github.com/snyk/cli/issues/3862 Signed-off-by: Craig Andrews <candrews@integralblue.com>
|
Hi Craig, we really appreciate the contribution. Unfortunately, it diverges a bit from our product vision and therefore we decided to close this PR. Thanks again, |
What does this PR do?
Adds a new command,
sbom, that produces an SBOM in the CycloneDX JSON 1.4 format.By default,
sbomwill just list the dependency files and the count of the dependencies each contains, for example:Passing the
--cyclonedx-jsonoption will output CycloneDX 1.4 JSON to stdout:Passing the
--cyclonedx-json-file-output=<file>option will output CycloneDX 1.4 JSON to the given file:The SBOM includes the dependencies (in the "components" section) and the dependency graph (in the "dependencies" section).
See: https://cyclonedx.org/
This feature facilitates compliance with the May 21, 2021 Executive Order on Improving the Nation’s Cybersecurity . It also bring Snyk CLI into alignment with the industry move towards SBOMs, of which Snyk itself has stressed the importance.
Where should the reviewer start?
I suggest looking at the new
sbomcommand's implementation.How should this be manually tested?
snyk sbom --target-dir <project>snyk sbom --target-dir <project> --cyclonedx-jsonsnyk sbom --target-dir <project> --cyclonedx-json-file-output=bom.jsonAs well as the other options as documented.
Any background context you want to provide?
The CycloneDX JSON file is constructed using https://www.npmjs.com/package/%40cyclonedx/cyclonedx-library
What are the relevant tickets?
Closes: https://github.com/snyk/cli/issues/3862
Screenshots
Additional questions