hansbusch / swiftbom Goto Github PK

View Code? Open in Web Editor NEW

This project forked from certcc/sbom

1.0 1.0 3.0 1.86 MB

Examples and proof-of-concept for Software Bill of Materials (SBOM) code & data

License: MIT License

JavaScript 91.00% CSS 1.14% HTML 7.86%

swiftbom's Introduction

SBOM

This repository contains a variant of the original SwiftBOM demo tool supporting enhanced SPDX component input.

A "Software Bill of Materials" (SBOM) is effectively a nested inventory, a list of ingredients that make up software components. You can learn more about SBOM at https://www.ntia.gov/sbom. There are several links to community developed documents in the NTIA's website.

SwiftBOM a SBOM generator tool here is part of CERT's work in supporting SBOM generation efforts for Proof-of-Concepts and Demo purposes. This tool is currently being explored by Healthcare Proof of Concept teams for their PoC efforts.

To start SwiftBOM either download the sources or run it via the following link SwiftBOM.

Import restrictions

Tagged SPDX format

Support for importing one or multiple files with automatic reference solving based on SPDXIDs.
Output is restricted to supported tags. Any additional tags are discarded on export.
In case input doesn't include SPDXID entries these will be filled with GUID values.
Relationship support restricted to 'CONTAINS' and 'DEPENDS_ON'.
The UI can only show a single parent per component. If multiple exist only one will be shown.
No support for file level information beyond package file names and their checksums.

RDF SPDX format

Experimental support for files with extension rdf

NPM

Creator field not filled automatically.

PIP

Creator and supplier fields not filled automatically.

Excel

Not supported.

SBOM Output Formats

SwiftBOM currently generates SBOM in SPDX, CycloneDX SWID formats. A tree graph is also generated by SwiftBOM that can be downloaded as a PNG file to quickly visualize relationships between components in an SBOM. Currently the tool uses CONTAINS as the default relationship mode (SWID Relationships)[https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/#71-relationship]. A generated SBOM in all three formats is currently a standalone document and does not support external relationships.

swiftbom's People

Contributors

Stargazers

Watchers

Forkers

pombredanne jacobgallucci moisalex

swiftbom's Issues

Support optional tags

Original implementation assumes that for each package the same tags are present. If not the association between tags and components gets messed up.

Propose to require PackageName as first tag of a component.

Import without Relationship DESCRIBES fails

Checksum implementation incomplete

Missing features:

Reading of checksums
Writing checksum information to formats other than tagged spdx

Add support for loading bom sets

Implementation assumes that first item is primary. When loading sets of boms then IDs may occur multiple times as reference in parent as well as primary in dependent bom.

Simplify parser component access by storing components as hash of component IDs.
Hash allows easy matching of existing bom entries avoiding duplicates

Only single creator supported

The UI supports just single creator, although SPDX may contain e.g. person and tool.

Import and export of CPE and PURL

Current implementation ignores input and outputs dummy content

Remove NOASSERTION on package relationship

Current implementation adds to each component the following line
Relationship: $SPDXID CONTAINS NOASSERTION

However we expect that all dependent components are fully declared. So why add this line?

Check Nuget external reference

An external nuget reference must consist of a name followed by a slash and followed by a version number.

Add verification regex.

Add check for LicenseRef

Internal defined license IDs must start with 'LicenseRef-'.

Add check to validation.

Verify license IDS

Any license ID provided shall be either taken from the license list in Annex A of the SPDX specification or it must be defined within the SBOM.

Check that valid only license IDs are used.

Parser reads <text> as tags

Parser should concatenate text instead of adding it to khash,

Backslash not allowed

Microsoft file locations have a backslash.

However backslashes are not allowed in Json.

Child BOM handling broken

Child BOM should support two modes:

read primary component into BOM
include full recursive content

Implementation looks very incomplete and does not even read primary component information but locks controls.

A component can only be included once
Any generator defining the inclusion otherwise will result in wrong association

Component add/remove incorrect

On first load one extra component is shown that needs to be removed before being able to export.

Subsequent loads add numerous additional empty components without possibility to remove.

Support for RDF

Some tools output RDF and it would be nice to be able to import.