feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM #3983

candrews · 2022-10-01T18:04:51Z

Follows CONTRIBUTING rules

What does this PR do?

Adds a new command, sbom, that produces an SBOM in the CycloneDX JSON 1.4 format.

By default, sbom will just list the dependency files and the count of the dependencies each contains, for example:

$ npx . sbom --target-dir /home/candrews/projects/test --fail-fast --all-projects
../test/build.gradle: Found 177 gradle dependencies
../test/frontend/yarn.lock: Found 111 yarn dependencies

Passing the --cyclonedx-json option will output CycloneDX 1.4 JSON to stdout:

$ npx . sbom --target-dir /home/candrews/projects/test --all-projects --fail-fast --cyclonedx-json

Passing the --cyclonedx-json-file-output=<file> option will output CycloneDX 1.4 JSON to the given file:

$ npx . sbom --target-dir /home/candrews/projects/test --all-projects --fail-fast --cyclonedx-json-file-output=bom.json

The SBOM includes the dependencies (in the "components" section) and the dependency graph (in the "dependencies" section).

See: https://cyclonedx.org/

This feature facilitates compliance with the May 21, 2021 Executive Order on Improving the Nation’s Cybersecurity . It also bring Snyk CLI into alignment with the industry move towards SBOMs, of which Snyk itself has stressed the importance.

Where should the reviewer start?

I suggest looking at the new sbom command's implementation.

How should this be manually tested?

snyk sbom --target-dir <project>
snyk sbom --target-dir <project> --cyclonedx-json
snyk sbom --target-dir <project> --cyclonedx-json-file-output=bom.json

As well as the other options as documented.

Any background context you want to provide?

The CycloneDX JSON file is constructed using https://www.npmjs.com/package/%40cyclonedx/cyclonedx-library

What are the relevant tickets?

Closes: https://github.com/snyk/cli/issues/3862

Screenshots

Additional questions

candrews · 2022-10-05T13:21:34Z

During our call on Monday, October 1, Snyk expressed interest in having the SBOM generation command be "snyk sbom" instead of "snyk deps" . I personally like "snyk deps" more, but I'd also be happy with any name :) Therefore, I've updated ths pull request with a commit that just changes the command name from "deps" to "sbom" with no other changes.

jkowalleck · 2022-10-23T13:51:46Z

hello everyone,

if the upgrade to TypeScript 4.8 (via #3875) was an issue,
i could imagine the https://www.npmjs.com/package/%40cyclonedx/cyclonedx-library could be modified to render inter-compatible type-definition files, instead of abusing its own TS-sources for this purpose :-)
if you feel like this could be helpful, feel free to open an issue here: https://github.com/CycloneDX/cyclonedx-javascript-library/issues

candrews · 2022-10-23T14:29:41Z

Regardless of what Snyk does with this request, I think it would be greatly beneficial to users of the CycloneDX library to publish these compatible type definitions to enhance its utility for other projects so I opened the issue at CycloneDX/cyclonedx-javascript-library#291

candrews · 2022-10-23T14:31:22Z

Snyk itself advises keeping dependencies up to date. So regardless of what Snyk wants to do with this request, I hope they will upgrade their Typescript dependency. I'm more than happy to work with Snyk to do with upgrade at #3875 if they would work with me.

jkowalleck · 2022-10-25T18:51:00Z

package-lock.json

+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "xmlbuilder2": "^3.0.2"


this is an optional depedency, that causes transitive dependnecies to install.
if you do not serialize to XML, then you could omit this optional dependency when adding @cyclonedx/cyclonedx-library as a dependency. see https://docs.npmjs.com/cli/v8/commands/npm-install#omit

from this PR it appears that the XML functionality is not used.

see https://github.com/snyk/cli/pull/3983/files#r1004859860

jkowalleck · 2022-10-25T18:52:57Z

src/cli/commands/sbom/index.ts

+        bomRef: `${targetFile}:${packageURL}`,
+      },
+    );
+    // The "snyk" property namespace has been reserved: https://github.com/CycloneDX/cyclonedx-property-taxonomy


jkowalleck · 2022-10-25T18:56:53Z

package-lock.json

@@ -19741,6 +19804,35 @@
        "node": ">=4.0"
      }
    },
+    "node_modules/xmlbuilder2": {


this is the optional dep from https://github.com/snyk/cli/pull/3983/files#r1004854642

CLAassistant · 2023-04-14T18:35:09Z

All committers have signed the CLA.

The SBOM includes the dependencies and the dependency graph. The SBOM is generated entirely client side; it does not communicate with the Snyk server/API. See: https://cyclonedx.org/ Closes: https://github.com/snyk/cli/issues/3862 Signed-off-by: Craig Andrews <[email protected]>

bastiandoetsch · 2023-05-26T08:06:40Z

Hi Craig,

we really appreciate the contribution. Unfortunately, it diverges a bit from our product vision and therefore we decided to close this PR.

Thanks again,
Bastian

candrews requested review from a team as code owners October 1, 2022 18:04

candrews requested review from a team, rontalx, gitphill, florindumitrascu and dagrest October 1, 2022 18:04

candrews force-pushed the cdx branch 4 times, most recently from f2a12f5 to 25a6052 Compare October 3, 2022 13:13

candrews changed the title ~~feat: add "deps" command that produces a CycloneDX 1.4 JSON SBOM~~ feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM Oct 5, 2022

candrews force-pushed the cdx branch 2 times, most recently from 7b102b1 to 54690c9 Compare October 13, 2022 23:41

candrews requested a review from a team as a code owner October 13, 2022 23:41

candrews force-pushed the cdx branch from 54690c9 to 4090c0f Compare October 13, 2022 23:45

candrews mentioned this pull request Oct 23, 2022

Render inter-compatible type-definition files CycloneDX/cyclonedx-javascript-library#291

Closed

candrews force-pushed the cdx branch from 4090c0f to 9c20954 Compare October 25, 2022 18:44

jkowalleck reviewed Oct 25, 2022

View reviewed changes

candrews force-pushed the cdx branch 2 times, most recently from 93e8a91 to 56ba629 Compare November 7, 2022 17:35

candrews mentioned this pull request Nov 17, 2022

feat: add purl to PkgInfo snyk/dep-graph#101

Merged

candrews force-pushed the cdx branch from 56ba629 to a9e32dd Compare November 21, 2022 14:11

candrews force-pushed the cdx branch from a9e32dd to dacaab0 Compare December 6, 2022 15:48

candrews force-pushed the cdx branch from dacaab0 to 1526aa9 Compare December 15, 2022 02:47

candrews force-pushed the cdx branch from 1526aa9 to 66635b0 Compare December 22, 2022 22:22

candrews force-pushed the cdx branch from 66635b0 to 948237e Compare February 7, 2023 15:04

candrews requested a review from a team as a code owner February 7, 2023 15:04

candrews force-pushed the cdx branch from 948237e to da20e6f Compare February 7, 2023 15:13

rontalx removed request for florindumitrascu and rontalx March 6, 2023 13:40

candrews mentioned this pull request Mar 15, 2023

tsconfig: default esModuleInterop & allowSyntheticDefaultImports CycloneDX/cyclonedx-javascript-library#243

Merged

candrews force-pushed the cdx branch from da20e6f to 4e13f38 Compare April 14, 2023 18:35

candrews requested a review from a team as a code owner April 14, 2023 18:35

candrews requested review from ofekatr and removed request for dagrest April 14, 2023 18:35

candrews force-pushed the cdx branch from 4e13f38 to f1386fc Compare April 14, 2023 18:58

ofekatr removed their request for review May 4, 2023 11:01

candrews force-pushed the cdx branch from f1386fc to 977a2f0 Compare May 19, 2023 13:06

candrews force-pushed the cdx branch from 977a2f0 to b2fba9e Compare May 19, 2023 20:07

bastiandoetsch closed this May 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM #3983

feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM #3983

candrews commented Oct 1, 2022 •

edited

Loading

candrews commented Oct 5, 2022

jkowalleck commented Oct 23, 2022 •

edited

Loading

candrews commented Oct 23, 2022

candrews commented Oct 23, 2022

jkowalleck Oct 25, 2022 •

edited

Loading

jkowalleck Oct 25, 2022

jkowalleck Oct 25, 2022

CLAassistant commented Apr 14, 2023 •

edited

Loading

bastiandoetsch commented May 26, 2023

feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM #3983

feat: add "sbom" command that produces a CycloneDX 1.4 JSON SBOM #3983

Conversation

candrews commented Oct 1, 2022 • edited Loading

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

Any background context you want to provide?

What are the relevant tickets?

Screenshots

Additional questions

candrews commented Oct 5, 2022

jkowalleck commented Oct 23, 2022 • edited Loading

candrews commented Oct 23, 2022

candrews commented Oct 23, 2022

jkowalleck Oct 25, 2022 • edited Loading

Choose a reason for hiding this comment

jkowalleck Oct 25, 2022

Choose a reason for hiding this comment

jkowalleck Oct 25, 2022

Choose a reason for hiding this comment

CLAassistant commented Apr 14, 2023 • edited Loading

bastiandoetsch commented May 26, 2023

candrews commented Oct 1, 2022 •

edited

Loading

jkowalleck commented Oct 23, 2022 •

edited

Loading

jkowalleck Oct 25, 2022 •

edited

Loading

CLAassistant commented Apr 14, 2023 •

edited

Loading