Package: mend-import-sbom
Import SBOMA CLI tool that imports a project inventory into Mend from a SBOM report in theSPDXformat or CSV format.The tool can either upload data directly to Mend, or alternatively, create a Mend Offline Request file that can be uploaded separately using one of the following methods:Using the Mend Unified Agent (seeUploading an Offline Request File)Via Mend's UI (Admin>>Upload Update Request)Using Mend's API (seeUploading Update Requests via the Mend API)The tool supports input files in eitherJSONorCSVformats.Import SBOMSupported Operating SystemsPrerequisitesInstallationUsageImporting SPDX SBOM (JSON)Imported File StructureExecution ExamplesImporting CSV SBOMImported File StructureExecution ExamplesSupported Operating SystemsLinux (Bash):CentOS, Debian, UbuntuWindows (PowerShell):10, 2012, 2016PrerequisitesPython 3.9+Mend user with admin permissionsInstallationpipinstallmend-import-sbomNote:Depending on whether the package was installed as a root user or not, you need to make sure the package installation location was added to the$PATHenvironment variable.UsageUsing command-line arguments only:import_sbom--user-key$WS_USERKEY--api-key$WS_APIKEY--url$WS_WSS_URL--input$SBOM_FILE_PATH--scope"ProductName//ProjectName"--dir$OUTPUT_DIRECTORYUsing environment variables:exportWS_USERKEY=xxxxxxxxxxxexportWS_APIKEY=xxxxxxxxxxxexportWS_WSS_URL=https://saas.mend.io

import_sbom--input$SBOM_FILE_PATH--scope"ProductName//ProjectName"Note:Either form is accepted. For the rest of the examples, the latter form would be usedConfiguration ParametersNote:Parameters can be specified as either command-line arguments, environment variables, or a combination of both.Command-line arguments take precedence over environment variables.CLI argumentEnv. VariableTypeRequiredDescription‑‑helpswitchNoShow help and exit‑‑versionswitchNoShow current version and exit‑‑user-keyWS_USERKEYstringYesMend User Key‑‑api-keyWS_APIKEYstringYesMend API Key‑‑urlWS_WSS_URLstringYesMend Server URL‑‑inputSBOMstringYesSBOM report file to import (*.jsonor*.csv)‑‑scopeWS_SCOPEstringNo*Product and Project names to create/update. Expected format:"PRODUCT//PROJECT"‑‑updateTypeWS_UPDATETYPEstringNoAPPEND or OVERRIDE results when importing into an existing project (default:OVERRIDE)‑‑dirstringNoOutput directory for theupdate-request.txtfile** in Offline mode (default:$PWD)‑‑offlineWS_OFFLINEboolNoCreate offline update request file without uploading to Mend (default:false)‑‑multilangWS_MULTILANGboolNo**In case no SHA1 searching library by All known package types (default:true)‑‑proxyHTTP_PROXYstringNoProxy host including port, with or without protocol prefix and optionally credentials. Expected formats:myproxy.host.com:1234,http://myproxy.host.com:1234,http://user:pass@myproxy.host.com:1234‑‑proxyUsernameHTTP_PROXY_USERNAMEstringNoProxy username, if needed and if not included in the proxy host.‑‑proxyPasswordHTTP_PROXY_PASSWORDstringNoProxy password, if needed and if not included in the proxy host.*--scopespecifies the hierarchy (full or partial) for uploading the SBOM report using product and project identifiers.
Both the product and project can be identified by either names (for creating a new one) or token (for updating an existing one).--scope "ProductName//ProjectName"would specify both the product name and project name to create/update.--scope "ProjectName"would specify only the project name, and the product name would default toMend-Imports.--scope "ProjectToken"would specify the token of an existing project, and the product name would default to that project's parent product. When specifying a project token, you cannot specify a product name/token.If--scopeisn't specified, the project name will be taken from the SBOM'snameproperty (for*.jsonSPDX) or its parent directory (for*.csv).** See more details about theupdate-request.txtfile andOffline modein Mend's documentation.** If--multilangis False script will try to find relevant package name in the Creator field. If such a candidate is found just it will be used for searching libraries.Importing SPDX SBOM (JSON)Imported File StructureThe SPDX document must correspond to theComposition of an SPDX documentspecification.The following table describes the set of properties for each imported library:PropertyRequiredDescriptionnameNoFile NamedownloadLocationNoDownload LocationlicenseConcludedNoLicense ConcludedlicenseInfoFromFilesNoLicense InfolicenseDeclaredNoLicense DeclaredcopyrightTextNoCopyright TextversionInfoYes*Version InfopackageFileNameYes*Package NamesupplierNoSupplieroriginatorNoOriginatorsha1Yes*SHA1homepageNoHome Page* Each library requires eithersha1or thepackageFileNameandversionInfopair.Note:Ifsha1isn't provided for a particular library, the tool will attempt to search that library by its name and version in Mend's index, which will result in longer execution times.Execution ExamplesNote:In the following examples, $WS_USERKEY, $WS_APIKEY and $WS_WSS_URL are assumed to have been exported as environment variables.Import SPDX SBOM into a new Mend projectimport_sbom--scope"$WS_PRODUCTNAME//$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/$WS_PROJECTNAME-sbom.jsonConvert SPDX SBOM to anoffline update requestfile for creating a new Mend project under a specific productimport_sbom--scope"$WS_PRODUCTNAME//$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/my-project-sbom.json--offlineTrueConvert SPDX SBOM to anoffline update requestfile for overriding an existing Mend projectimport_sbom--scope"$WS_PRODUCTNAME//$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/my-project-sbom.json--offlineTrue

import_sbom--scope$WS_PROJECTTOKEN--dir$HOME/reports--input$HOME/reports/my-project-sbom.json--offlineTrueConvert SPDX SBOM to anoffline update requestfile for appending to an existing Mend projectimport_sbom--scope"$WS_PRODUCTNAME//$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/my-project-sbom.json--offlineTrue--updateTypeAPPEND

import_sbom--scope$WS_PROJECTTOKEN--dir$HOME/reports--input$HOME/reports/my-project-sbom.json--offlineTrue--updateTypeAPPENDImporting CSV SBOMImported File StructureDownload CSV TemplateHeaderRequiredReferencenameNoFile NamedownloadLocationNoDownload LocationlicenseConcludedNoLicense ConcludedlicenseInfoFromFilesNoLicense InfolicenseDeclaredNoLicense DeclaredcopyrightTextNoCopyright TextversionInfoYes*Version InfopackageFileNameYes*Package NamesupplierNoSupplieroriginatorNoOriginatorsha1Yes*SHA1homepageNoHome Page* Each library requires eithersha1or thepackageFileNameandversionInfopair. Other fields can remain empty.Note:Ifsha1isn't provided for a particular library, the tool will attempt to search that library by its name and version in Mend's index, which will result in longer execution times.Execution ExamplesNote:In the following examples, $WS_USERKEY, $WS_APIKEY and $WS_WSS_URL are assumed to have been exported as environment variables.Import CSV SBOM into a new Mend project under the default product (Mend-Imports)import_sbom--scope"$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/$WS_PROJECTNAME.csvImport CSV SBOM, appending to an existing Mend projectimport_sbom--scope"$WS_PRODUCTNAME//$WS_PROJECTNAME"--dir$HOME/reports--input$HOME/reports/$WS_PROJECTNAME.csv--updateTypeAPPEND

import_sbom--scope$WS_PROJECTTOKEN--dir$HOME/reports--input$HOME/reports/$WS_PROJECTNAME.csv--updateTypeAPPEND