sbom-tool下载及使用详解

github地址

GitHub - microsoft/sbom-tool: The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

简介

SBOM工具是一个高度可扩展的企业级工具，用来为各种工件创建SPDX 2.2兼容的SBOM。

下载及安装

由于笔者的环境是Ubuntu，因此选择Linux下载方式。具体命令为：

curl -Lo sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
chmod +x sbom-tool

注：命令会下载到当前路径下，因此可以在运行命令之前选择好目标路径。

运行

查看帮助

运行带-h参数的指令，以查看用法，如下所示：

$ ./sbom-tool -h

The Sbom tool generates a SBOM for any build artifact.

Usage - Microsoft.Sbom.Tool <action> -options

GlobalOption    Description
Help (-?, -h)   Prints this help message

Actions

  Validate -options - Validate a build artifact using the manifest. Optionally also verify the signing certificate of the manfiest.

    Option                   Description
    BuildDropPath (-b)       The root folder of the drop directory to validate.
    ManifestDirPath (-m)     The path of the directory where the manifest will be validated. If this parameter is not specified, the manifest will be validated in {BuildDropPath}/_manifest directory.
    OutputPath (-o)          The path where the output json should be written.
    CatalogFilePath (-C)     The path of signed catalog file that is used to verify the signature of the manifest json file.
    ValidateSignature (-s)   If set, will validate the manifest using the signed catalog file.
    IgnoreMissing (-im)      If set, will not fail validation on the files presented in Manifest but missing on the disk.
    RootPathFilter (-r)      If you're downloading only a part of the drop using the '-r' or 'root' parameter in the drop client, specify the same string value here in order to skip validating paths that
                             are not downloaded.
    HashAlgorithm (-Ha)      The Hash algorithm to use while verifying or generating the hash value of a file
    Verbosity (-V)           Display this amount of detail in the logging output.
                             Verbose
                             Debug
                             Information
                             Warning
                             Error
                             Fatal
    Parallelism (-P)         The number of parallel threads to use for the workflows.
    ConfigFilePath (-Co)     The json file that contains the configuration for the DropValidator.
    TelemetryFilePath (-t)   Specify a file where we should write detailed telemetry for the workflow.
    FollowSymlinks (-F)      If set to false, we will not follow symlinks while traversing the build drop folder. Default is set to 'true'.
    ManifestInfo (-mi)       A list of the name and version of the manifest format that we are using.

  Generate -options - Generate a SBOM for all the files in the given build drop folder, and the packages in the components path.

    Option                                    Description
    BuildDropPath (-b)                        The root folder of the drop directory for which the SBOM file will be generated.
    BuildComponentPath (-bc)                  The folder containing the build components and packages.
    BuildListFile (-bl)                       The file path to a file containing a list of files one file per line for which the SBOM file will be generated. Only files listed in the file will be
                                              inlcuded in the generated SBOM.
    ManifestDirPath (-m)                      The path of the directory where the generated SBOM files will be placed. A folder named '_manifest' will be created at this location, where all generated
                                              SBOMs will be placed. If this parameter is not specified, the files will be placed in {BuildDropPath}/_manifest directory.
    PackageName (-pn)                         The name of the package this SBOM represents. If this is not provided, we will try to infer this name from the build that generated this package, if that
                                              also fails, the SBOM generation fails.
    PackageVersion (-pv)                      The version of the package this SBOM represents. If this is not provided, we will try to infer the version from the build that generated this package, if
                                              that also fails, the SBOM generation fails.
    DockerImagesToScan (-di)                  Comma separated list of docker image names or hashes to be scanned for packages, ex: ubuntu:16.04, 56bab49eef2ef07505f6a1b0d5bd3a601dfc3c76ad4460f24c91d6fa298
                                              369ab.
    AdditionalComponentDetectorArgs (-cd)     Additional set of arguments for Component Detector.  An appropriate usage of this would be a space-delimited list of `--key value` pairs, respresenting
                                              command-line switches.
    ExternalDocumentReferenceListFile (-er)   The path to a file containing a list of external SBOMs that will be included as external document reference in the output SBOM. SPDX 2.2 is the only
                                              supported format for now.
    NamespaceUriUniquePart (-nsu)             A unique valid URI part that will be appended to the SPDX SBOM namespace URI. This value should be globally unique.
    NamespaceUriBase (-nsb)                   The base path of the SBOM namespace URI.
    GenerationTimestamp (-gt)                 A timestamp in the format 'yyyy-MM-ddTHH:mm:ssZ' that will be used as the generated timestamp for the SBOM.
    DeleteManifestDirIfPresent (-D)           If set to true, we will delete any previous manifest directories that are already present in the ManifestDirPath without asking the user for confirmation.
                                              The new manifest directory will then be created at this location and the generated SBOM will be stored there.
    Verbosity (-V)                            Display this amount of detail in the logging output.
                                              Verbose
                                              Debug
                                              Information
                                              Warning
                                              Error
                                              Fatal
    Parallelism (-P)                          The number of parallel threads to use for the workflows.
    ConfigFilePath (-C)                       The json file that contains the configuration for the DropValidator.
    TelemetryFilePath (-t)                    Specify a file where we should write detailed telemetry for the workflow.
    FollowSymlinks (-F)                       If set to false, we will not follow symlinks while traversing the build drop folder. Default is set to 'true'.
    ManifestInfo (-mi)                        A list of the name and version of the manifest format that we are using.

生成SBOM

运行以下命令以对某一文件夹生成SBOM：

generate -b <drop path> -bc <build components path> -pn <package name> -pv <package version> -nsb <namespace uri base>

具体命令及结果如下：

$ ./sbom-tool generate -b ./dst_dir/ -bc ./glibc-2.36/ -pn glibc -pv 1.0 -nsb http://ftp.gnu.org/pub/gnu/glibc/

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

[INFO] Log file: /tmp/GovCompDisc_Log_20220819151906.log 
[INFO] Run correlation id: 58189840-a22b-4447-a735-da59e3eab41e 

[INFO] Attempting to load default detectors 
[INFO] 19 detectors were found in Microsoft.ComponentDetection.Detectors
 
[WARN] Provided search path /var/tmp/.net/ph/sbom-tool/gudhhs1u.p03/Plugins does not exist. 


[INFO] Finding components... 
[INFO] Starting enumeration of /home/ph/dingdao/glibc-2.36/ 
[INFO] No instructions received to scan docker images. 
[INFO] Enumerated 19221 files and 716 directories in 00:00:00.9775240 
[INFO]  
[INFO] _______________________________________________________________________________________________________________________________________ 
[INFO] |Component Detector Id         |Detection Time                |# Components Found            |# Explicitly Referenced                 | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |CocoaPods                     |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Go                            |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Gradle                        |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Ivy (Beta)                    |0.048 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Linux                         |0.031 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |MvnCli                        |0.048 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Npm                           |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NpmWithRoots                  |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NuGet                         |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NuGetProjectCentric           |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Pip                           |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Pnpm                          |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Ruby                          |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |RustCrateDetector             |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |RustCrateV2Detector           |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |SPDX22SBOM                    |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Yarn                          |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Total                         |1 seconds                     |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO]  

[INFO] Detection time: 1.0169676 seconds. 
[INFO] Scan Manifest file: /tmp/ScanManifest_20220819151906.json 
No usable version of libssl was found
已放弃 (核心已转储)

获得更详细的过程，命令及结果如下：

$ ./sbom-tool generate -b ./dst_dir/ -bc ./evtest_1.35.orig/ -pn glibc -pv 1.0 -nsb https://launchpad.net/ubuntu/+source/evtest/1:1.35-1 -V Verbose
##[debug]Starting SBOM generation workflow.
##[debug]Using the CGScannedExternalDocumentReferenceFileProvider provider for the files workflow.
##[debug]Scanning for packages under the root path ./evtest_1.35.orig/.
##[debug]Splitting the workflow into 8 threads.
##[debug]Running the generation workflow ...

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

[INFO] Log file: /tmp/GovCompDisc_Log_20220819153154.log 
[INFO] Run correlation id: 97ab0cf4-e985-4b8f-aee8-8a1cd632f8b6 

[INFO] Attempting to load default detectors 
[INFO] 19 detectors were found in Microsoft.ComponentDetection.Detectors
 
[WARN] Provided search path /var/tmp/.net/ph/sbom-tool/gudhhs1u.p03/Plugins does not exist. 
[VERBOSE] Finished applying restrictions to detectors. 


[INFO] Finding components... 
[VERBOSE] shrinkwrap.yaml:pnpm-lock.yaml 
[VERBOSE] Cargo.lock 
[VERBOSE] Gemfile.lock 
[VERBOSE] Cargo.lock 
[VERBOSE] yarn.lock 
[VERBOSE] *.spdx.json 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Pnpm.PnpmComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Ruby.RubyComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Yarn.YarnLockComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Spdx.Spdx22ComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Rust.RustCrateV2Detector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Rust.RustCrateDetector 
[VERBOSE] project.assets.json 
[VERBOSE] setup.py:requirements.txt 
[VERBOSE] package.json 
[VERBOSE] *.nupkg:*.nuspec:nuget.config 
[VERBOSE] Podfile.lock 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.NuGet.NuGetProjectModelProjectCentricComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Pip.PipComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Npm.NpmComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.NuGet.NuGetComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.CocoaPods.PodComponentDetector 
[VERBOSE] package-lock.json:npm-shrinkwrap.json:lerna.json 
[VERBOSE] go.mod:go.sum 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Npm.NpmComponentDetectorWithRoots 
[VERBOSE] pom.xml 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Go.GoComponentDetector 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Maven.MvnCliComponentDetector 
[VERBOSE] *.lockfile 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Gradle.GradleComponentDetector 
[INFO] Starting enumeration of /home/ph/dingdao/evtest_1.35.orig/ 
[INFO] No instructions received to scan docker images. 
[VERBOSE] ivy.xml 
[VERBOSE] Registered Microsoft.ComponentDetection.Detectors.Ivy.IvyDetector 
[VERBOSE] Skipping Ivy detection as ant is not available in the local PATH. 
[VERBOSE] Skipping maven detection as maven is not available in the local PATH. 
[INFO] Enumerated 8 files and 0 directories in 00:00:00.0159805 
[INFO]  
[INFO] _______________________________________________________________________________________________________________________________________ 
[INFO] |Component Detector Id         |Detection Time                |# Components Found            |# Explicitly Referenced                 | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |CocoaPods                     |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Go                            |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Gradle                        |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Ivy (Beta)                    |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Linux                         |0.031 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |MvnCli                        |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Npm                           |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NpmWithRoots                  |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NuGet                         |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |NuGetProjectCentric           |0.046 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Pip                           |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Pnpm                          |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Ruby                          |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |RustCrateDetector             |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |RustCrateV2Detector           |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |SPDX22SBOM                    |0.044 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Yarn                          |0.045 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO] |Total                         |0.055 seconds                 |0                             |0                                       | 
[INFO] |______________________________|______________________________|______________________________|________________________________________| 
[INFO]  

[INFO] Detection time: 0.0547157 seconds. 
[INFO] Scan Manifest file: /tmp/ScanManifest_20220819153154.json 
##[debug]Using the DirectoryTraversingFileToJsonProvider provider for the files workflow.
##[debug]Enumerating files under the root path ./dst_dir/.
##[debug]Splitting the workflow into 8 threads.
##[debug]Running the generation workflow ...
##[debug]Using the CGScannedPackagesProvider provider for the packages workflow.
##[debug]Scanning for packages under the root path ./evtest_1.35.orig/.
##[debug]Splitting the workflow into 8 threads.
##[debug]Running the generation workflow ...
##[debug]Using cached CD scan result for the call with the same arguments
##[debug]Wrote 0 package elements in the SBOM.
##[debug]Found value for header PackageName in internal metadata.
##[debug]Found value for header PackageVersion in internal metadata.
No usable version of libssl was found
已放弃 (核心已转储)