Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security(tools): software bill of materials generation #2081

Closed
petermetz opened this issue Jun 16, 2022 · 0 comments · Fixed by #2082
Closed

security(tools): software bill of materials generation #2081

petermetz opened this issue Jun 16, 2022 · 0 comments · Fixed by #2082
Assignees
@petermetz

Comments

@petermetz
Copy link
Contributor

Description

As a maintainer I want to have the ability to generate a comprehensive SBoM easily with a single script so that when it's time to release the software we can do this easily (and fully automated in the future of course via GitHub actions)

Acceptance Criteria

  1. Place a script in the ./tools/ directory that can generate SBoM(s) for the entire project
  2. The output should be formatted as .spdx
  3. Multiple .spdx files are acceptible since we have multiple sub-projects (e.g. the mono repo) within the main git repository anyway
@petermetz petermetz self-assigned this Jun 16, 2022
petermetz added a commit to petermetz/cacti that referenced this issue Jun 16, 2022
@petermetz
build(tools): software bill of materials generation
f6cbc3e 
Added a script to generate all SBoMs.
The short hand to call the script is by running
$ yarn generate-sbom
and then it saves all the different .spdx
files under ./dist/sbom/*
where the file names are derived from
the relative path of the directory of the
build definition.

Fixes hyperledger-cacti#2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz mentioned this issue Jun 16, 2022
Merged
petermetz added a commit to petermetz/cacti that referenced this issue Jul 11, 2022
@petermetz
build(tools): software bill of materials generation
da78302 
Added a script to generate all SBoMs.
The short hand to call the script is by running
$ yarn generate-sbom
and then it saves all the different .spdx
files under ./dist/sbom/*
where the file names are derived from
the relative path of the directory of the
build definition.

Fixes hyperledger-cacti#2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Jul 19, 2023
@petermetz
build(tools): software bill of materials generation for npm packages
4fe5534 
Added a script to generate a .csv SBoM for npm package dependencies.
The short hand to call the script is by running
$ yarn tools:generate-sbom
and then it saves all a .csv file with the combined output under
`./dist/sbom/`

Fixes hyperledger-cacti#2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Jul 22, 2023
@petermetz
build(tools): software bill of materials generation for npm packages
97287bb 
Added a script to generate a .csv SBoM for npm package dependencies.
The short hand to call the script is by running
$ yarn tools:generate-sbom
and then it saves all a .csv file with the combined output under
`./dist/sbom/`

Fixes hyperledger-cacti#2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit that referenced this issue Jul 22, 2023
@petermetz
build(tools): software bill of materials generation for npm packages
8f1d1f3 
Added a script to generate a .csv SBoM for npm package dependencies.
The short hand to call the script is by running
$ yarn tools:generate-sbom
and then it saves all a .csv file with the combined output under
`./dist/sbom/`

Fixes #2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
sandeepnRES pushed a commit to sandeepnRES/cacti that referenced this issue Dec 21, 2023
@petermetz @sandeepnRES
build(tools): software bill of materials generation for npm packages
842c360 
Added a script to generate a .csv SBoM for npm package dependencies.
The short hand to call the script is by running
$ yarn tools:generate-sbom
and then it saves all a .csv file with the combined output under
`./dist/sbom/`

Fixes hyperledger-cacti#2081

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@petermetz petermetz

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

build(tools): software bill of materials generation petermetz/cacti
1 participant
@petermetz