mobster 2.0.0

A tool for generating and managing Software Bill of Materials (SBOM).

Mobster

The Mobster project is a Python-based tool and ecosystem to work with SBOM (Software Bill of Materials) documents. Its goal is to provide unified interface for generating, manipulating and consuming SBOM documents in various formats.

The tools is designed to cover a whole lifecycle of SBOM documents. The major stages are:

• Generation: Generate SBOMs document from various sources (Syft, Hermeto, etc.)
• Augmentation: Augment SBOM documents with additional information that are not present in the phase of generation. This phase is usually done in the release phase where we know more information about the software.
• Validation: Validate a quality of the SBOM document in different stages of the lifecycle. The validation is done by the Product Security team guidelines.
• Distribution: Distribute the SBOM document to various set of locations (e.g. Trusted Profile Analyzer, container registry, etc.)

Getting started

To use the Mobster tool, you need to install it first. There are multiple ways to isnstall the tool:

Using pip

pip install mobster
mobster --help

Using container image

podman pull quay.io/konflux-ci/mobster:latest
podman run -it quay.io/konflux-ci/mobster:latest mobster --help

Additional dependencies

Some features of Mobster require additional dependencies to be installed outside of Python ecosystem. To use those features, you need to install the following tools:

• oras: Used for pushing and pulling SBOM documents to/from OCI registries.
• cosign: Used for signing and verifying SBOM documents in OCI registries.
• syft: Used for generating SBOM documents from container images and filesystems.

Development environment

Follow an instruction in the development-environment.md file to set up your development environment.

Contributing

We welcome contributions to the Mobster project! If you would like to contribute, please follow these steps:

1. Fork the repository
2. Create a new branch for your feature or bug fix
3. Make your changes and commit them with a clear message (following the conventional commit format) (e.g. feat: add new feature or fix: fix a bug)
4. Open a pull request to the main repository
5. Make sure the CI checks pass and the code is properly formatted
6. Wait for the review and address any comments or suggestions
7. Once your changes are approved, they will be merged into the main branch
8. Congratulations! You have successfully contributed to the Mobster project

Release process

The release process is automated using GitHub Actions and Konflux. The process is described in detail in the release.md file.

Documentation

The documentation for the Mobster project is available at the Mobster Gitbub pages.

License

This project is licensed under the Apache License 2.0. See the LICENSE file for details.