@appthreat/cdxgen
Creates CycloneDX Software Bill-of-Materials (SBOM) for node.js, python, java and golang projects
Last updated 6 days ago by prabhus .
Apache-2.0 · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install @appthreat/cdxgen 
SYNC missed versions from official npm registry.

CycloneDX Generator

This script creates a valid CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for node.js, python, java and Go projects. Optionally, it can submit the generated BOM to dependency track or AppThreat server for analysis. CycloneDX is a lightweight SBOM specification that is easily created, human and machine readable, and simple to parse.

Supported languages and package format

Language Package format
node.js package-lock.json
java maven (pom.xml), gradle (build.gradle)
python requirements.txt, Pipfile.lock, poetry.lock
go go.sum, Gopkg.lock
rust Cargo.lock
.Net core .csproj

NOTE:

  • Apache maven is required for parsing pom.xml
  • gradle or gradlew is required to parse gradle projects
  • For Go projects, license information is obtained via GitHub api lookups. This approach is not comprehensive yet

Usage

Installing

npm install -g @appthreat/cdxgen

Getting Help

$ cdxgen -h
Options:
  --version, -v      Print version number                              [boolean]
  --output, -o       Output file for bom.xml. Default console
  --type, -t         Project type
  --server-url       Dependency track or AppThreat server url. Eg:
                     https://deptrack.appthreat.io
  --api-key          Dependency track or AppThreat server api key
  --project-name     Dependency track or AppThreat project name. Default use the
                     directory name
  --project-version  Dependency track or AppThreat project version. Default
                     master                                  [default: "master"]
  --project-id       Dependency track or AppThreat project id. Either provide
                     the id or the project name and version together
  -h                 Show help                                         [boolean]

Example

cdxgen -o bom.xml

Integration with GitHub action

Use the GitHub action to automatically generate and upload bom to the server. Refer to nodejs.yml in this repo for a working example.

Integration with Google CloudBuild

Use this custom builder and refer to the readme for instruction.

License

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.

Current Tags

  • 1.4.15                                ...           latest (6 days ago)

25 Versions

  • 1.4.15                                ...           6 days ago
  • 1.4.14                                ...           14 days ago
  • 1.4.13                                ...           a month ago
  • 1.4.12                                ...           a month ago
  • 1.4.11                                ...           a month ago
  • 1.4.10                                ...           a month ago
  • 1.4.9                                ...           a month ago
  • 1.4.8                                ...           a month ago
  • 1.4.7                                ...           a month ago
  • 1.4.6                                ...           a month ago
  • 1.4.5                                ...           2 months ago
  • 1.4.4                                ...           2 months ago
  • 1.4.3                                ...           2 months ago
  • 1.4.2                                ...           3 months ago
  • 1.4.1                                ...           3 months ago
  • 1.4.0                                ...           3 months ago
  • 1.3.0                                ...           3 months ago
  • 1.2.4                                ...           4 months ago
  • 1.2.3                                ...           4 months ago
  • 1.2.2                                ...           5 months ago
  • 1.2.1                                ...           5 months ago
  • 1.2.0                                ...           5 months ago
  • 1.1.0                                ...           5 months ago
  • 1.0.4                                ...           5 months ago
  • 1.0.2                                ...           5 months ago
Maintainers (1)
Downloads
Today 0
This Week 0
This Month 0
Last Day 0
Last Week 33
Last Month 124
Dependencies (12)
Dev Dependencies (1)
Dependents (0)
None

Copyright 2014 - 2016 © taobao.org |