Package: distro2sbom
DISTRO2SBOMThe DISTRO2SBOM generates a
SBOM (Software Bill of Materials) for either an installed application or a complete system installation in a number of formats includingSPDXandCycloneDX.
An SBOM for an installed package will identify all of its dependent components.It is intended to be used as part of a continuous integration system to enable accurate records of SBOMs to be maintained
and also to support subsequent audit needs to determine if a particular component (and version) has been used.InstallationTo install use the following command:pip install distro2sbomAlternatively, just clone the repo and install dependencies using the following command:pip install -U -r requirements.txtThe tool requires Python 3 (3.7+). It is recommended to use a virtual python environment especially
if you are using different versions of python.virtualenvis a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.Usageusage: distro2sbom [-h] [--distro {rpm,deb,windows,auto}] [-i INPUT_FILE] [-n NAME] [-r RELEASE] [-p PACKAGE] [-s] [-d] [--sbom {spdx,cyclonedx}] [--format {tag,json,yaml}]
                   [-o OUTPUT_FILE] [-V]

Distro2Sbom generates a Software Bill of Materials for the specified package or distribution.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit

Input:
  --distro {rpm,deb,windows,auto}
                        type of distribution (default: auto)
  -i INPUT_FILE, --input-file INPUT_FILE
                        name of distribution file
  -n NAME, --name NAME  name of distribution
  -r RELEASE, --release RELEASE
                        release identity of distribution
  -p PACKAGE, --package PACKAGE
                        identity of package within distribution
  -s, --system          generate SBOM for installed system

Output:

Output:
  -d, --debug           add debug information
  --sbom {spdx,cyclonedx}
                        specify type of sbom to generate (default: spdx)
  --format {tag,json,yaml}
                        specify format of software bill of materials (sbom) (default: tag)
  -o OUTPUT_FILE, --output-file OUTPUT_FILE
                        output filename (default: output to stdout)OperationThe--distrooption is used to identify the type of distribution. The default option is auto which attempts to determine the type of distribution by searching for the
presence of key applications required by the tool. If none of the required applications are found, the tool terminates.The--nameoption and--releaseoption is used to identify the name and release of the distribution. These options are
optional but if they are specified, values for both options are required. If they are not specified, values for these options shall be obtained from system files installed on the system.The--input-fileoption is used to provide a filename containing the list of packages installed on the system. The format of the file is dependent on the specified--distrooption.deb. The file used is the output of the following commanddpkg-l>[filename.out]Sample file contentsDesired=Unknown/Install/Remove/Purge/Hold| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)||/ Name                                             Version                             Architecture Description+++-================================================-===================================-============-==================================================================================ii  acl                                              2.3.1-1                             amd64        access control list - utilitiesii  adduser                                          3.129                               all          add and remove users and groupsii  adwaita-icon-theme                               43-1                                all          default icon theme of GNOMEii  alien                                            8.95.6                              all          convert and install rpm and other packagesii  alsa-tools                                       1.2.5-2                             amd64        Console based ALSA utilities for specific hardwarerpm. The file used is the output of the following command.Notethat it is recommended to sort the list of files as this makes it easier to find the packages in the SBOM.rpm-qa|sort>[filename.out]Sample file contentsaccountsservice-0.6.55-10.el9.x86_64accountsservice-libs-0.6.55-10.el9.x86_64acl-2.3.1-3.el9.x86_64adcli-0.9.1-7.el9.x86_64adwaita-cursor-theme-40.1.1-3.el9.noarchadwaita-icon-theme-40.1.1-3.el9.noarchwindows. The file used is the output of the following commandget-wmiobject-classwin32_product|Out-file-filePath[filename.out]Sample file contentsIdentifyingNumber : {....}Name              : Python 3.10.5 Utility Scripts (64-bit)Vendor            : Python Software FoundationVersion           : 3.10.5150.0Caption           : Python 3.10.5 Utility Scripts (64-bit)If the specified filename is not found, the tool will terminate.The--packageoption is used to identify the name of a package or application installed on the system. If the specified package or application is not found, the tool terminates.
This option is not supported if the--distrooption is set to 'windows'.The--systemoption is used to generate an SBOM for all the applications installed on the system. Note that this option will take some time to complete as it is dependent on the number of installed applications.
This option is not supported if the--distrooption is set to 'windows'.At least one of the--input-file,--packageor--systemoptions must be specified. If multiple options are specified, the--input-fileoption followed by the--systemoption will be assumed.The--sbomoption is used to specify the format of the generated SBOM (the default is SPDX). The--formatoption
can be used to specify the formatting of the SBOM (the default is Tag Value format for a SPDX SBOM). JSON format is supported for both
SPDX and CycloneDX SBOMs.The--output-fileoption is used to control the destination of the output generated by the tool. The
default is to report to the console but can be stored in a file (specified using--output-fileoption).ExamplesSBOM for an Installed PackageTo generate an SBOM for the installed zip package.distro2sbom--distroauto--name<distroname>--release<distrorelease>--packagezipThis will automatically detect the type of distribution and generate an SBOM in SPDX Tag value format to the console.SBOM for DistributionTo generate an SBOM for a system distribution.distro2sbom--distrodeb--name<distroname>--release<distrorelease>--input-file<distrofile>--sbomcyclonedx--output-file<distrooutfile>This will generate an SBOM in CycloneDX JSON value for a distribution file in dpkg format (indicated by the 'deb' option)SBOM for SystemTo generate an SBOM for an installed system, obtaining the name and release of the system from installed system files.distro2sbom--distrodeb--system--formatjson--output-file<distrooutfile>This will generate an SBOM in SPDX JSON value for a distribution file in dpkg format (indicated by the 'deb' option)LicenceLicenced under the Apache 2.0 Licence.LimitationsThis tool is meant to support software development and security audit functions. However, the usefulness of the tool is dependent on the SBOM data
which is provided to the tool. Unfortunately, the tool is unable to determine the validity or completeness of such a SBOM file; users of the tool
are therefore reminded that they should assert the quality of any data which is provided to the tool.When processing and validating licenses, the application will use a set of synonyms to attempt to map some license identifiers to the correctSPDX License Identifiers. However, the
user of the tool is reminded that they should assert the quality of any data which is provided by the tool particularly where the license identifier has been modified.Dependencies between applications are only produced for the--packageand--systemoptions.The--packageoption is not supported if the--distrooption is set to 'windows'.WhilstPURLandCPEreferences are automatically generated for components, the accuracy
of such references cannot be guaranteed as they are dependent on the validity of the data associated with the component.Feedback and ContributionsBugs and feature requests can be made via GitHub Issues.