Package: csbom
csbom cli toolThis is a cli tool that parses an SBOM outputted by Scribe Security valint tool, formatted as CycloneDX, and creates a csv file containing the following.InstallationNotice:the tool is still in development, therefore it is suggested not to install it directly to your PATH. Instead, you could create a virtual python environment using python'svirtualenvtool.With this tool, you can create an environment with the commandvirtualenv <env_name>. virtualenv will create a directory in your current directory named<env_name>.To activate your environment, on Linux/Mac you can runsource <env_name>/bin/activateand on windows,.\env_name\Scripts\activateTo exit the environment, rundeactivateand your terminal should go back to normal.While in the venv, do this to install (this way, the tool will only be installed in the virtual environment):Using the python package manager, runpip install csbom==1.0.3Example of installing and running csbom in a virtual environment:# Create a virtual environment named `venv`$virtualenvvenv
createdvirtualenvironmentCPython3.10.10.final.0-64in159mscreatorCPython3Posix(dest=<dest_path>,clear=False,no_vcs_ignore=False,global=False)seederFromAppData(download=False,pip=bundle,setuptools=bundle,wheel=bundle,via=copy,app_data_dir=<app_dir>ApplicationSupport/virtualenv)addedseedpackages:pip==23.2.1,setuptools==68.0.0,wheel==0.41.0activatorsBashActivator,CShellActivator,FishActivator,NushellActivator,PowerShellActivator,PythonActivator# Activate the virtual environment$sourcevenv/bin/activate# Install csbom tool(venv)$pipinstallcsbom==1.0.3
Collectingcsbom==1.0.3Obtainingdependencyinformationforcsbom==1.0.3fromhttps://files.pythonhosted.org/packages/9f/17/0350e4e05ed2a2adfa349a0da074e46f65f0a9d66ddecc485541eb78f799/csbom-1.0.1-py3-none-any.whl.metadataDownloadingcsbom-1.0.1-py3-none-any.whl.metadata(5.6kB)Collectingclick>=7.1.2(fromcsbom==1.0.3)Obtainingdependencyinformationforclick>=7.1.2fromhttps://files.pythonhosted.org/packages/00/2e/d53fa4befbf2cfa713304affc7ca780ce4fc1fd8710527771b58311a3229/click-8.1.7-py3-none-any.whl.metadataDownloadingclick-8.1.7-py3-none-any.whl.metadata(3.0kB)Downloadingcsbom-1.0.3-py3-none-any.whl(10kB)Downloadingclick-8.1.7-py3-none-any.whl(97kB)━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━97.9/97.9kB3.7MB/seta0:00:00
Installingcollectedpackages:click,csbom
Successfullyinstalledclick-8.1.7csbom-1.0.3# Now, you can run csbom in your virtual environment!(venv)$whichcsbom
.../venv/bin/csbom# Using the csbom tool(venv)$csbomdep2tablebom.json-oanalysis.csv
Dependencytablesuccessfullygeneratedat`analysis.csv`!# To exit the virtual environment(venv)$deactivate# Notice that the (venv) disappears after calling deactivate$exitThe tool can still be installed and run normally without a virtual environment, this is just an example for how to install it exclusively in a virtual environment.Usage & Explanationscsbom CMD [OPTIONS] ARGGeneral Options:--help: display help information-o (--output): Choose output filename (defaultdep/file/commit-analysis.csv, depending on command)-a (--append-to):  Optional, if present, csbom will append the output to the already existing csv specified  \Commands:dep2table: Given an SBOM generated with the '--components files' flag, output a table of important info,file2table: Given an SBOM as the argument, outputs a table of components of type file,git2table: Given an SBOM generated from a Git repo (with --components commits), outputs a table with all commit information,version: displays current versionfile2tableThis command takes the SBOM and generates a CSV with 5 columns,bomref,name,hash,mimetime,mode, andlast_commitEach row contains an entry from thecomponentsarray in the SBOM file with the corresponding information. If a component does not contain an entry for any of these 5 categories, it will be marked as Nonedep2tableThis command creates a CSV table of depender components mapped to dependee components, with information ofname,type,purl,hashes, andgroupfor each component.git2tableThis command creates a CSV table of git commits with 6 columns,bomref,type(which should always be commit),name,commit-author,commit-message, andcommit-timestamp, for each commit in the SBOM.versiondisplays the current version information