Mend SBOM Generator

This tool generates SBOM reports in either SPDX or CycloneDX formats, for specified projects.

The tool can be executed either via CLI or as a Docker container.

Note: This tool utilizes a forked package of spdx-tools.

SBOM Generator CLI

Supported Operating Systems

• Linux (Bash): CentOS, Debian, Ubuntu, RedHat
• Windows (PowerShell): 10, 2012, 2016

Prerequisites

• Python 3.8 or later
• Mend user with admin permissions

Note:
The specified user (-u, --userKey) must be associated with a group assigned as either Organization Administrators (for generating report for all projects in the organization) or Product Administrators. For the latter, --tokenType must be specified (see Command-Line Arguments).

Installation

1. Install the PyPI package ws-sbom-generator

   pip install ws-sbom-generator
   

   Note: Depending on whether the package was installed as a root user or not, you need to make sure the package installation location was added to the $PATH environment variable.

2. Update the creation info as needed in the resource/sbom_extra.json file:

   {
     "namespace": "http://CreatorWebsite/pathToSpdx/DocumentName-UUID",
     "org_email": "org@domain.com",
     "person": "First Last",
     "person_email": "first.last@domain.com"
   }
   

Usage

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --type $FORMAT --out $HOME/reports --extra resources/sbom_extra.json

Command-Line Arguments

Notes:
* Token type (--tokenType product) is required in case the specified userKey is associated with a group with Product Administrators permissions.
* Report type (--type) cdx will generate a JSON file in CycloneDX v1.4 format.
* Report type (--type) all will generate one file in each format for each specified project.
* Output file name (--outfile) is only supported for a single project scope.
* Full license texts will be taken by default from the SPDX License List. If a given license does not exist there, the tool will attempt to take it from Mend's database.
* By default, the tool will use the placeholders in the resource/sbom_extra.json file.

Execution Examples

Generating tv formatted SBOM report for a specific project

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --scope $WS_PROJECTTOKEN --out $HOME/reports --extra sbom_extra.json

Generating tv formatted SBOM report for all projects of a specified product

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --scope $WS_PRODUCTTOKEN --out $HOME/reports --extra sbom_extra.json

Generating json formatted SBOM report for all projects in the organization

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --type json --out $HOME/reports

Generating json formatted SBOM report for all projects in the organization, including full license text

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --type json --out $HOME/reports --licensetext True

Generating xml formatted SBOM report for a single project (executed by a product administrator)

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_PRODUCTTOKEN --tokenType product --scope $WS_PROJECTTOKEN --type xml --out $HOME/reports --extra sbom_extra.json

Generating json formatted SBOM report for a single project, specifying file name

ws_sbom_generator --wsUrl $WS_WSS_URL --userKey $WS_USERKEY --token $WS_APIKEY --scope $WS_PROJECTTOKEN --type json --out $HOME/reports --extra sbom_extra.json --outfile my-project-sbom.json

SBOM Generator Docker Container

Supported Operating Systems

• Linux: CentOS, Debian, Ubuntu, RedHat
• Windows: 10, 2012, 2016

Prerequisites

• Docker version 20 or later
• Mend user with admin permissions

Note:
The specified user (-u, --userKey) must be associated with a group assigned as either Organization Administrators (for generating report for all projects in the organization) or Product Administrators. For the latter, --tokenType must be specified (see Command-Line Arguments).

Installation

docker pull whitesourcetools/ws-sbom-generator:latest 

Usage

docker run --name ws-sbom-generator \ 
  -v $HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom-generator/resources \ 
  -v $HOME/reports:/opt/ws-sbom-generator/sbom-generator/output \
  -e WS_URL=$WS_WSS_URL \
  -e WS_USER_KEY=$WS_USERKEY \ 
  -e WS_TOKEN=$WS_APIKEY \
  -e WS_REPORT_TYPE=<REPORT_TYPE> \
  whitesourcetools/ws-sbom-generator 

Execution Examples

Running as organization administrator, generating json formatted SBOM reports for all projects, default extra args

docker run --name ws-sbom-generator \  
  -v $HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources \ 
  -v $HOME/reports:/opt/ws-sbom-generator/sbom_generator/output \
  -e WS_URL=$WS_WSS_URL \
  -e WS_USER_KEY=$WS_USERKEY \ 
  -e WS_TOKEN=$WS_APIKEY \
  -e WS_REPORT_TYPE=json
  whitesourcetools/ws-sbom-generator

Running as organization administrator, generating tv formatted SBOM report for a single project, default extra args

docker run --name ws-sbom-generator \  
  -v $HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources \
  -v $HOME/reports:/opt/ws-sbom-generator/sbom_generator/output \
  -e WS_URL=$WS_WSS_URL \
  -e WS_USER_KEY=$WS_USERKEY \
  -e WS_TOKEN=$WS_APIKEY \
  -e WS_SCOPE_TOKEN=<WS_PROJECT_TOKEN> \
  whitesourcetools/ws-sbom-generator

Running as a product administrator, generating rdf formatted SBOM report for a single project, default extra args

docker run --name ws-sbom-generator \  
  -v $HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources \
  -v $HOME/reports:/opt/ws-sbom-generator/sbom_generator/output \
  -e WS_URL=$WS_WSS_URL \
  -e WS_USER_KEY=$WS_USERKEY \
  -e WS_TOKEN=$WS_PRODUCTTOKEN \
  -e WS_TOKEN_TYPE=product
  -e WS_SCOPE_TOKEN=$WS_PROJECTTOKEN \
  whitesourcetools/ws-sbom-generator