12 Star 108 Fork 30

京东开源 / sbom-tool

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
MulanPSL-2.0

SBOM-TOOL

English | 简体中文

SBOM-TOOL 是通过源码仓库、代码指纹、构建环境、制品信息、制品内容、依赖组件等多种维度信息,为软件项目生成软件物料清单(SBOM)的一款CLI工具。

功能特性

信息采集

  • 采集源代码工程信息,包括仓库地址、版本信息等
  • 采集并生成代码指纹,利用一定算法生成代码指纹
  • 采集工程构建依赖环境信息,包括操作系统、内核、编译器、构建工具等
  • 采集工程构建的依赖组件,支持多种语言、多种包管理器的依赖采集
  • 采集最终制品包信息,包括包名、类型、唯一校验码等
  • 采集制品内容信息,包括文件名类型、唯一校验码等

SBOM文档

  • 组装SBOM文档,基于上述采集的信息组装标准SBOM文档
  • 规范格式转换,支持XSPDX、SPDX等规范,支持JSON等格式
  • 规范格式校验,支持XSPDX、SPDX等规范,支持JSON等格式

代码指纹生成能力

开发语言 是否支持
C/C++
Java
C#
Dart
Golang
Javascript
Objective-C
Php
Python
Ruby
Rust
Swift
Lua

依赖包扫描能力

现已支持以下编程语言相关的配置文件解析、二进制包解析,后续会逐步支持更多的编程语言。

包类型 包管理器 解析文件 是否支持依赖图谱
maven Maven
  • pom.xml
  • *.jar
  • *.war
  • [graph]maven-dependency-tree.txt(mvn dependency:tree -DoutputFile=maven-dependency-tree.txt)
maven Gradle
  • *.gradle
  • .gradle.lockfile
  • [graph]gradle-dependency-tree.txt(gradlew gradle-baseline-java:dependencies > gradle-dependency-tree.txt)
conan Conan
  • conanfile.txt
  • conan.lock
  • [graph]conan-graph-info.json(conan graph info -f json > conan-graph-info.json)
npm NPM
  • package.json
  • package-lock.json
npm Yarn
  • [graph]yarn.lock
npm PNPM
  • [graph]pnpm.lock
golang Go Module
  • go.mod
  • Go Binary file
  • [graph]go-mod-graph.txt(go mod graph > go-mod-graph.txt)
golang Glide
  • glide.yml
  • glide.yaml
golang GoDep
  • Godeps.json
golang Dep
  • Gopkg.toml
golang GVT
  • */vendor/manifest
pypi PIP
  • Pipfile.lock
  • *dist-info/METADATA
  • PKG-INFO
  • *requirements*.txt
  • setup.py
  • [graph]pipenv-graph.txt(pipenv graph > pipenv-graph.txt)
pypi Poetry
  • [graph]poetry.lock
conda Conda
  • environment.yml
  • environment.yaml
  • package-list.txt
composer Composer
  • composer.json
  • composer.lock
cargo Cargo
  • Cargo.toml
  • [graph]Cargo.lock
  • Rust Binary file
carthage Carthage
  • Cartfile
  • Cartfile.resolved
swift SwiftPM
  • Package.swift
cocoapods Cocoapods
  • Podfile.lock
  • Podfile
  • *.podspec
gem Gem
  • [graph]Gemfile.lock
  • Gemfile
  • *.gemspec
nuget NuGet
  • [graph]*.deps.json
  • *.csproj
  • *.vbproj
  • *.fsproj
  • *.vcproj
  • *.nuget.dgspec.json
  • *.nuspec
  • packages.json
  • packages.lock.json
pub Pub
  • [graph]pub-deps.json(dart pub deps --json > pub-deps.json)
  • pubspec.lock
  • pubspec.yaml
rpm RPM
  • *.spec
deb DEB
  • *.deb
  • *.control
lua LuaRocks
  • *.rockspec
bower Bower
  • *.spec

软件架构

SBOM-TOOL整体架构

下载安装

  1. 下载源码编译(需要 go 1.18 及以上版本)
    git clone git@gitee.com:JD-opensource/sbom-tool.git
    cd sbom-tool
    make
    默认生成多个系统架构的程序二进制包
    • Linux X86_64:sbom-tool-linux-amd64
    • Linux arm64:sbom-tool-linux-arm64
    • Windows X86_64:sbom-tool-windows-amd64.exe
    • Windows arm64:sbom-tool-windows-arm64.exe
    • MacOS amd64: sbom-tool-darwin-amd64
    • MacOS arm64: sbom-tool-darwin-arm64

或者通过 go install 安装

   go install gitee.com/JD-opensource/sbom-tool/cmd/sbom-tool@latest

或者通过下载二进制文件安装: SBOM-TOOL发行版

子命令说明

子命令 功能
help 工具帮助手册
artifact 采集软件包制品信息
assembly 把各阶段生成的文档组装为SBOM文档
completion 为指定的shell生成自动完成脚本
convert 转换SBOM文档格式
env 生成环境信息
generate 生成SBOM文档
package 收集包依赖项
source 收集源代码信息
validate 验证SBOM文档格式
info 获取工具介绍信息
modify 修改SBOM文档属性

参数说明

参数 短参数 描述 使用样例
--log-level 指定日志级别,包括 debuginfowarnerror --log-level info
--log-path 指定日志路径,默认在用户主目录下自动生成日志目录及日志文件($home/sbom-tool/sbom-tool.log) --log-path /tmp/sbom.log
--quiet -q 无控制台输出 --quiet -q
--ignore-dirs 要忽略的目录,跳过所有点目录,以逗号分隔。示例:NODE_MODULES,LOGS --ignore-dirs log,logs
--language -l 指定语言(目前支持:javacpp)(默认为“*”) --language java -l cpp
--parallelism -m 并发度(默认为8) --parallelism 4 -m 9
--output -o 指定结果输出文件存放路径及名称,默认会在当前目录下自动生成 --output /tmp/sbom.json
--src -s 指定源代码存放路径,默认为当前目录 --src /tmp/sbomtool/src/
--path -p 指定项目工程主目录;assembly子命令中用于指定各阶段临时文档路径 --path /tmp/sbomtool/
--dist -d 指定制品存放路径,默认为当前目录 --dist /tmp/sbomtool/bin/
--format -f 指定SBOM文档格式(目前支持:xspdx-jsonspdx-jsonspdx-tagvalue)(默认为spdx-json) --format spdx-json -f spdx-json
--input -i 指定SBOM文档作为输入 --input /tmp/sbom.jsom
--algorithm -a 用于指定生成SBOM文档标识的算法(目前支持:SHA1SHA256SM3)(默认为SM3) --algorithm SHA256

SBOM文档规范与格式

规范 格式 SBOM文档格式 是否支持
XSPDX JSON xspdx-json 已支持
SPDX JSON spdx-json 已支持
SPDX TagValue spdx-tagvalue 已支持

XSPDX 是基于SPDX扩展的SBOM格式规范

使用示例

生成SBOM文档并指定格式

sbom-tool generate -m 4 -p ${project_path} -s ${src_path} -d ${dist_path}  -o sbom.spdx.json -f spdx-json --ignore-dirs .git  -n ${name} -v ${version} -u ${supplier} -b ${namespace}

获取工具介绍信息

sbom-tool info

更多使用案例,详见文档

开发指南

详见 开发指南文档

问题反馈&联系我们

如果在使用中遇到问题,欢迎您向我们提交ISSUE。

如何贡献

SBOM-TOOL 是一款开源的软件成分分析工具,期待您的贡献。

许可证

此项目是在 MulanPSL2 下授权的,有关详细信息,请参阅许可证文件

木兰宽松许可证, 第2版 木兰宽松许可证, 第2版 2020年1月 http://license.coscl.org.cn/MulanPSL2 您对“软件”的复制、使用、修改及分发受木兰宽松许可证,第2版(“本许可证”)的如下条款的约束: 0. 定义 “软件”是指由“贡献”构成的许可在“本许可证”下的程序和相关文档的集合。 “贡献”是指由任一“贡献者”许可在“本许可证”下的受版权法保护的作品。 “贡献者”是指将受版权法保护的作品许可在“本许可证”下的自然人或“法人实体”。 “法人实体”是指提交贡献的机构及其“关联实体”。 “关联实体”是指,对“本许可证”下的行为方而言,控制、受控制或与其共同受控制的机构,此处的控制是指有受控方或共同受控方至少50%直接或间接的投票权、资金或其他有价证券。 1. 授予版权许可 每个“贡献者”根据“本许可证”授予您永久性的、全球性的、免费的、非独占的、不可撤销的版权许可,您可以复制、使用、修改、分发其“贡献”,不论修改与否。 2. 授予专利许可 每个“贡献者”根据“本许可证”授予您永久性的、全球性的、免费的、非独占的、不可撤销的(根据本条规定撤销除外)专利许可,供您制造、委托制造、使用、许诺销售、销售、进口其“贡献”或以其他方式转移其“贡献”。前述专利许可仅限于“贡献者”现在或将来拥有或控制的其“贡献”本身或其“贡献”与许可“贡献”时的“软件”结合而将必然会侵犯的专利权利要求,不包括对“贡献”的修改或包含“贡献”的其他结合。如果您或您的“关联实体”直接或间接地,就“软件”或其中的“贡献”对任何人发起专利侵权诉讼(包括反诉或交叉诉讼)或其他专利维权行动,指控其侵犯专利权,则“本许可证”授予您对“软件”的专利许可自您提起诉讼或发起维权行动之日终止。 3. 无商标许可 “本许可证”不提供对“贡献者”的商品名称、商标、服务标志或产品名称的商标许可,但您为满足第4条规定的声明义务而必须使用除外。 4. 分发限制 您可以在任何媒介中将“软件”以源程序形式或可执行形式重新分发,不论修改与否,但您必须向接收者提供“本许可证”的副本,并保留“软件”中的版权、商标、专利及免责声明。 5. 免责声明与责任限制 “软件”及其中的“贡献”在提供时不带任何明示或默示的担保。在任何情况下,“贡献者”或版权所有者不对任何人因使用“软件”或其中的“贡献”而引发的任何直接或间接损失承担责任,不论因何种原因导致或者基于何种法律理论,即使其曾被建议有此种损失的可能性。 6. 语言 “本许可证”以中英文双语表述,中英文版本具有同等法律效力。如果中英文版本存在任何冲突不一致,以中文版为准。 条款结束 如何将木兰宽松许可证,第2版,应用到您的软件 如果您希望将木兰宽松许可证,第2版,应用到您的新软件,为了方便接收者查阅,建议您完成如下三步: 1, 请您补充如下声明中的空白,包括软件名、软件的首次发表年份以及您作为版权人的名字; 2, 请您在软件包的一级目录下创建以“LICENSE”为名的文件,将整个许可证文本放入该文件中; 3, 请将如下声明文本放入每个源文件的头部注释中。 Copyright (c) [Year] [name of copyright holder] [Software Name] is licensed under Mulan PSL v2. You can use this software according to the terms and conditions of the Mulan PSL v2. You may obtain a copy of Mulan PSL v2 at: http://license.coscl.org.cn/MulanPSL2 THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. See the Mulan PSL v2 for more details. Mulan Permissive Software License,Version 2 Mulan Permissive Software License,Version 2 (Mulan PSL v2) January 2020 http://license.coscl.org.cn/MulanPSL2 Your reproduction, use, modification and distribution of the Software shall be subject to Mulan PSL v2 (this License) with the following terms and conditions: 0. Definition Software means the program and related documents which are licensed under this License and comprise all Contribution(s). Contribution means the copyrightable work licensed by a particular Contributor under this License. Contributor means the Individual or Legal Entity who licenses its copyrightable work under this License. Legal Entity means the entity making a Contribution and all its Affiliates. Affiliates means entities that control, are controlled by, or are under common control with the acting entity under this License, ‘control’ means direct or indirect ownership of at least fifty percent (50%) of the voting power, capital or other securities of controlled or commonly controlled entity. 1. Grant of Copyright License Subject to the terms and conditions of this License, each Contributor hereby grants to you a perpetual, worldwide, royalty-free, non-exclusive, irrevocable copyright license to reproduce, use, modify, or distribute its Contribution, with modification or not. 2. Grant of Patent License Subject to the terms and conditions of this License, each Contributor hereby grants to you a perpetual, worldwide, royalty-free, non-exclusive, irrevocable (except for revocation under this Section) patent license to make, have made, use, offer for sale, sell, import or otherwise transfer its Contribution, where such patent license is only limited to the patent claims owned or controlled by such Contributor now or in future which will be necessarily infringed by its Contribution alone, or by combination of the Contribution with the Software to which the Contribution was contributed. The patent license shall not apply to any modification of the Contribution, and any other combination which includes the Contribution. If you or your Affiliates directly or indirectly institute patent litigation (including a cross claim or counterclaim in a litigation) or other patent enforcement activities against any individual or entity by alleging that the Software or any Contribution in it infringes patents, then any patent license granted to you under this License for the Software shall terminate as of the date such litigation or activity is filed or taken. 3. No Trademark License No trademark license is granted to use the trade names, trademarks, service marks, or product names of Contributor, except as required to fulfill notice requirements in Section 4. 4. Distribution Restriction You may distribute the Software in any medium with or without modification, whether in source or executable forms, provided that you provide recipients with a copy of this License and retain copyright, patent, trademark and disclaimer statements in the Software. 5. Disclaimer of Warranty and Limitation of Liability THE SOFTWARE AND CONTRIBUTION IN IT ARE PROVIDED WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL ANY CONTRIBUTOR OR COPYRIGHT HOLDER BE LIABLE TO YOU FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO ANY DIRECT, OR INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING FROM YOUR USE OR INABILITY TO USE THE SOFTWARE OR THE CONTRIBUTION IN IT, NO MATTER HOW IT’S CAUSED OR BASED ON WHICH LEGAL THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 6. Language THIS LICENSE IS WRITTEN IN BOTH CHINESE AND ENGLISH, AND THE CHINESE VERSION AND ENGLISH VERSION SHALL HAVE THE SAME LEGAL EFFECT. IN THE CASE OF DIVERGENCE BETWEEN THE CHINESE AND ENGLISH VERSIONS, THE CHINESE VERSION SHALL PREVAIL. END OF THE TERMS AND CONDITIONS How to Apply the Mulan Permissive Software License,Version 2 (Mulan PSL v2) to Your Software To apply the Mulan PSL v2 to your work, for easy identification by recipients, you are suggested to complete following three steps: i Fill in the blanks in following statement, including insert your software name, the year of the first publication of your software, and your name identified as the copyright owner; ii Create a file named “LICENSE” which contains the whole context of this License in the first directory of your software package; iii Attach the statement to the appropriate annotated syntax at the beginning of each source file. Copyright (c) [Year] [name of copyright holder] [Software Name] is licensed under Mulan PSL v2. You can use this software according to the terms and conditions of the Mulan PSL v2. You may obtain a copy of Mulan PSL v2 at: http://license.coscl.org.cn/MulanPSL2 THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE. See the Mulan PSL v2 for more details.

简介

SBOM-TOOL 是通过源码仓库、代码指纹、构建环境、制品信息、制品内容、依赖组件等多种维度信息,为软件项目生成软件物料清单(SBOM)的一款CLI工具。 展开 收起
MulanPSL-2.0
取消

发行版 (1)

全部

贡献者

全部

近期动态

加载更多
不能加载更多了
Go
1
https://gitee.com/JD-opensource/sbom-tool.git
git@gitee.com:JD-opensource/sbom-tool.git
JD-opensource
sbom-tool
sbom-tool
master

搜索帮助