interlynk-io/sbomex

Find & pull public SBOMs

sbomex: SBOM Explorer

sbomex is a command line utility to help query and pull from Interlynk's public SBOM repository. The tool is intended to help familiarize with the specifications and formats of common SBOM standards and the quality of produced SBOMs (See sbomqs - SBOM Quality Score for how the score is computed).

The underlying repository is updated periodically with SBOMs from a variety of sources built with many tools.

sbomex search : Search repository for matching SBOMs

search commands finds SBOMs in the repository that matches given filtering criteria (specification, format or tool name)

sbomex search --format json --spec cdx --tool trivy --target '%centos%7' --limit 3

  ID  TARGET                 QUALITY  TYPE      CREATOR
  14  centos:centos7.9.2009  7.38     cdx-json  trivy-0.36.1
  23  centos:centos7         7.38     cdx-json  trivy-0.36.1
  32  centos:7.9.2009        7.38     cdx-json  trivy-0.36.1

sbomex pull : Downloads specified SBOM from the repository and prints to the screen

sbomex pull --id 23

{
   "SPDXID": "SPDXRef-DOCUMENT",
   "creationInfo": {
   	"created": "2023-03-01T01:32:02.939561Z",
   	"creators": [
   		"Tool: trivy",
   		"Organization: aquasecurity"
   	]
   },
   "dataLicense": "CC0-1.0",
...

Using containerized sbomex

docker run ghcr.io/interlynk-io/sbomex [search|pull] [options]

Example

docker run ghcr.io/interlynk-io/sbomex:latest search --format json --spec cdx --tool trivy --target '%box%' --limit 3

Unable to find image 'ghcr.io/interlynk-io/sbomex:latest' locally
latest: Pulling from interlynk-io/sbomex
bc89d6624a71: Already exists
bacb9c1935ff: Already exists
Digest: sha256:a00682b085fd21b7f071245a4d62d4825a07d9e783a8dfcda6b1f30f6a49514c
Status: Downloaded newer image for ghcr.io/interlynk-io/sbomex:latest
downloading db 100% |███████████████████████████| (89/89 MB, 5.4 MB/s)

A new version of sbomex is available v0.0.6.

  ID   TARGET          QUALITY  TYPE      CREATOR
  95   busybox:latest  3.25     cdx-json  trivy-0.36.1
  104  busybox:uclibc  3.25     cdx-json  trivy-0.36.1
  113  busybox:musl    3.25     cdx-json  trivy-0.36.1

SBOM Card

Installation

Using Prebuilt binaries

https://github.com/interlynk-io/sbomex/releases

Using Homebrew

brew tap interlynk-io/interlynk
brew install sbomex

Using Go install

go install github.com/interlynk-io/sbomex@latest

Using repo

This approach invovles cloning the repo and building it.

1. Clone the repo git clone [email protected]:interlynk-io/sbomex.git
2. cd into sbomex folder
3. make build
4. To test if the build was successful run the following command ./build/sbomex version

Contributions

We look forward to your contributions, below are a few guidelines on how to submit them

• Fork the repo
• Create your feature/bug branch (git checkout -b feature/new-feature)
• Commit your changes (git commit -am "awesome new feature")
• Push your changes (git push origin feature/new-feature)
• Create a new pull-request

Other SBOM Open Source tools

• SBOM Assembler - A tool to compose a single SBOM by combining other (part) SBOMs
• SBOM Quality Score - A tool for evaluating the quality and completeness of SBOMs
• SBOM Search Tool - A tool to grep style semantic search in SBOMs
• SBOM Explorer - A tool for discovering and downloading SBOM from a public repository

Contact

We appreciate all feedback. The best ways to get in touch with us:

• ☎️ Live Chat
• 📫 Email Us
• 🐛 Report a bug or enhancement
• ❌ Follow us on X

Stargazers

If you like this project, please support us by starring it.

sbomex's Issues

search command should support target search

sbomex search command should support --name flag. User should be able to pass name as a pattern e.g

sbomex search --name '%cen%'
sbomex search --name '%box%'

Remove --filter flags from fetch command

As discussed, we should remove filter flag from fetch command.

sbomex fetch automatically downloads a file. It should not

./build/sbomex fetch

command downloads a file and prints it to the screen, this should not happen. We should only download a file, when --id is provided.

Add release support by adding goreleaser workflow

Refer to sbomqs and add goreleaser workflow.

bom-v0.4.1 SBOMs don't contain distro information for Debian?

Appreciate this is more of a problem with the upstream tool, but I wanted to flag the data quality aspect here.

Here's an example of a Debian SBOM created using bom-v0.4.1:

sbomex pull --id 442

This contains references like:

pkg:deb/debian/[email protected]?arch=s390x

From the purl spec:

There is no default package repository: this should be implied either from the distro qualifiers key or using a base url as a repository_url qualifiers key.

Basically the purl is incomplete. Without the distro information the purl here is ambiguous. I'd argue based on the spec it's technically an invalid purl, but the spec as written is a bit hard to parse. But whether or not it's invalid, it's not specific without the distro information.

Update help description for the fetch command

build/sbomex fetch --help

downloads specified SBOM from the repository and prints to the screen

Usage:
sbomex fetch [flags]

Flags:
[Remove this one for now] --filter string Filter SBOM based on conditions provided
-h, --help help for fetch
--id int Fetch SBOM based on the input Id

Update Readme

@surendrapathak we need to update the README.

Update help description for the search command

build/sbomex fetch --help
finds SBOM in the repository that matches the filtering criteria

Usage:
sbomex search [flags]

Flags:
--format string SBOM format options json/xml/tv
-h, --help help for search
--limit int max number of search results to print (default 25)
--spec string SBOM Specification options spdx/cdx
--tool string SBOM creator tool name (e.g. syft, trivy, bom)

Provide linux arm64 build

Please consider adding a Linux arm64 release.

CGO_ENABLED should be set to on

Since we are using sqlite db, they makefile should change CGO_ENABLED=1.

Update help description for the tool

[Text marked in bold below must be added to the help]

Text:
sbomex help

SBOM Explorer (sbomex) is a command line utility to help query and fetch Interlynk's public SBOM repository. The tool is intended to help familiarize with the specifications and formats of common SBOM standards and the quality of produced SBOMs (See sbomqs). The underlying repository is updated periodically with SBOMs from a variety of sources built with many tools

Usage:
sbomex [command]

Available Commands:
completion Generate the autocompletion script for the specified shell
fetch downloads specified SBOM from the repository and prints to the screen
help Help about any command
search finds SBOM in the repository that matches the filtering criteria

Flags:
-h, --help help for sbomex
-t, --toggle Help message for toggle

Use "sbomex [command] --help" for more information about a command.

Invalid spec/format values have usability issues

The error message is always "invalid spec." It should be called out specifically.

Error messages:

1. spec options are spdx or cdx
2. format options are xml , json or tv (for tag-value)

Example of better error handling below -

1. Shows the error string
2. Prints help message

sbomqs score ~/Downloads/09-07-2022.csv --reportFormat basic2
Error: report format options are basic or detailed
Usage:
  sbomqs score [flags]

Flags:
      --category string       scoring category
      --dirpath string        sbom dir path
      --filepath string       sbom file path
  -h, --help                  help for score
      --reportFormat string   reporting format basic/detailed/json

Change fetch command to pull command

Change the fetch command to pull command to match related services. Here are the changes:

1. command name in the help and description changed as follows

build/sbomex --help

....
fetch Downloads specified SBOM from the repository and prints to the screen
pull Pulls specified SBOM from the repository and prints to the screen

2. build/sbomex pull --help
   Pulls specified SBOM from the repository and prints to the screen

Usage:
sbomex pull [flags]

Flags:
[Remove this one for now] --filter string Filter SBOM based on conditions provided
-h, --help help for pull
--id int Pull SBOM based on the input Id

3. Update README.md - @surendrapathak is on this.

Download Latest DB

Add support to download latest sbom db.

• Check if .interlynk-io/sbomex/sqlite3.db exists
• NOT then create all directories
• Download latest file from github-repo, decide latest file logic
• Download file and save to 1
• Open DB

version command is not working

It needs to match version details (sbomqs example attached) -

Input validations for --id field

Please check input validations for --id fields.

./sbomex fetch --id -1
./sbomex fetch --id 12312312312321

all return bad data.

Containerize sbomex and host on ghcr

Need to provide sbomqs as a container, and hosted on ghcr. This should ease integration.

Document these steps in the README