This Buildroot python application generates CycloneDX Software Bill of Materials
(SBOM) containing all direct dependencies of a Buildroot generated project.
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for
cyber risk reduction.
Buildroot provides a build target named "legal-info" which produces a set of files including manifest.csv. The legal-info
is a general "make" target for a Buildroot project.
By default, manifest.csv
will be read from the current working directory
and the resulting bom.json
will also be created in the current working directory.
This can be overwritten as follows:
$ python3 generateBuildrootSBOM.py -i <path>/manifest.csv -n "My Project" -v "1.2.3.4" -m "company name" -c cpe.json
Usage: generateBom.cli [OPTIONS]
Options:
-i <path> - filename of the output from make legal-info, example: manifest.csv
-o <path> - the bom file name to create
-n name of the project or product SBOM <project name in quotes>
-v your product SBOM version <project version in quotes>
-m SBOM manufacturer name
-c <path> - cpe file name resulting from Buildroot targets: "make show-info" or "make pkg-stats"
Diagram depicting where this project fits into the pipeline of secure development activities. Note that while the diagram depicts a linear sequence of activities, the entire sequence is typically cyclical. The end state of SBOM management receives the SBOM files for the product versions to properly manage the state of vulnerabilities over time.
The following table provides information on the version of this module, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this module that is compatible with the CycloneDX version supported by the target system.
Version | Schema Version | Format(s) |
---|---|---|
1.0x | CycloneDX v1.4 | XML/JSON |
CycloneDX Buildroot is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.