Package: sbomaudit
SBOMAUDITSBOMAUDIT reports on the quality of the contents of an SBOM (Software Bill of Materials) by performing a number of checks. SBOMs are supported in a number of formats includingSPDXandCycloneDX.InstallationTo install use the following command:pip install sbomauditAlternatively, just clone the repo and install dependencies using the following command:pip install -U -r requirements.txtThe tool requires Python 3 (3.7+). It is recommended to use a virtual python environment especially
if you are using different versions of python.virtualenvis a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.Usageusage: sbomaudit [-h] [-i INPUT_FILE] [--offline] [--cpecheck] [--purlcheck] [--disable-license-check] [--age AGE] [--maxage MAXAGE] [--allow ALLOW] [--deny DENY] [--verbose] [--debug] [-o OUTPUT_FILE] [-V]

SBOMAudit reports on the quality of the contents of a SBOM.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit

Input:
  -i INPUT_FILE, --input-file INPUT_FILE
                        Name of SBOM file
  --offline             operate in offline mode
  --cpecheck            check for CPE specification
  --purlcheck           check for PURL specification
  --disable-license-check
                        disable check for SPDX License identifier
  --age AGE             minimum age of package (as integer representing days) to report (default: 0)
  --maxage MAXAGE       maximum age of package (as integer representing years) to report (default: 2)
  --allow ALLOW         Name of allow list file
  --deny DENY           Name of deny list file
  --verbose             verbose reporting

Output:
  --debug               add debug information
  -o OUTPUT_FILE, --output-file OUTPUT_FILE
                        output filename (default: output to stdout)OperationThe--input-fileoption is used to specify the SBOM to be processed. The format of the SBOM is determined according to
the following filename conventions.SBOMFormatFilename extensionSPDXTagValue.spdxSPDXJSON.spdx.jsonSPDXYAML.spdx.yamlSPDXYAML.spdx.ymlCycloneDXJSON.jsonCycloneDXXML.xmlThe--offlineoption is used when the tool is used in an environment where access to external systems is not available. This means
that some audit checks are not performed.The--cpecheckand--purlcheckoptions are used to enable additional checks related to a SBOM component.The--disable-license-checkoption is used to disable the check that the licenses have validSPDX License identifiers.The--ageoption can be used to report if a recent release of a package is being used.The--maxageoption can be used to report if the release date of a package, which is not the latest version, is greater than the value specified. The default value is 2 years.The--allowand--denyoptions are used to specify additional checks related to licenses and packages which are to be allowed or denied within a SBOM component.
Anallowfile contains the set of licenses and packages which to be contained within the SBOM; this may be useful to ensure that the SBOM does not contain any
unapproved licenses or packages not identified in a software design. Adenyfile is used to specify the licenses and packages which must not be contained within the SBOM.The--verboseoption can be used to report the results of all the checks performed; the default is just report failed checks and summaries.The--output-fileoption is used to control the destination of the output generated by the tool. The
default is to report to the console but can be stored in a file (specified using--output-fileoption).Allow and Deny list file formatsThe files are text files consisting of two sectionsList of SPDX license identifiersLst of Package namesEach section is optional.In this sample allow file, this would only allow cemponents with the MIT, Apache-2.0 or BSD-3-Clause licenses.
It is also only expecting a single package 'click'.# This is an example ALLOW list file for SBOMAUDIT# Allowed licenses[license]MIT
Apache-2.0
BSD-3-Clause# Allowed packages[package]clickChecks PerformedThe following section identifies the checks which are performed.SBOM FormatThe following checks are performed:Check that the version of the SBOM is either version 2.2 or 2.3 (SPDX) or version 1.3, 1.4 or 1.5 (CycloneDX).Check that a creator is defined.Check that the time that the SBOM is created is defined.FilesThe following checks are performed for each file item:Check that a file name is specified.Check that the file type is specified.Check that a license is specified and that the license identified is a validSPDX License identifier. Note that NOASSERTION is not considered a valid license.Check that the license is anOSI Approvedlicense.Optionally check that the license is allowed as specified in the ALLOW listOptionally check that the license is not included in the licenses specified in the DENY listCheck that a copyright statement is specified. Note that NOASSERTION is not considered a valid copyright statement.PackagesThe following checks are performed on each package item:Check that a package name is specified.Optionally check that the package name is allowed as specified in the ALLOW listOptionally check that the package name is not included in the packages specified in the DENY listCheck that a supplier is specified.Check that a version is specified.Check that the package version is the latest released version of the package. The latest version checks are only performed if the--offlineoption is not specified.Check that a mature version of the package is being used as determined by the value specified in the--ageoption. The release date checks are only performed if the--offlineoption is not specified.Check the age of a package being used, which is not the latest released version, is greater than the value specified in the--maxageoption.
The check is only performed if the--offlineoption is not specified.Check that a license is specified and that the license identified is a validSPDX License identifier. Note that NOASSERTION is not considered a valid license.Check that the license is anOSI Approvedlicense.Optionally check that the license is allowed as specified in the ALLOW listOptionally check that the license is not included in the licenses specified in the DENY listCheck that aPURL specificationis provided for the package.Check that aCPE specificationis provided for the package.Latest package version checksThe checks for the latest package version are performed for packages within the following language ecosystems:dartgojavajavascript.netperlpythonrrubyrustswiftRelationshipsThe following checks are performed:Check that relationships are defined.Check that every file is included in at least one relationship.Check that every package is included in at least one relationship.NTIA ConformanceThe following checks are performed:Check that the contents of the SBOM meet the minimum requirements for an SBOM as defined by theNTIA.ExampleGiven the following SBOM (click.json){
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "serialNumber": "urn:uuided03b5fe-42a8-41ee-b68f-114aa6fcead9",
  "version": 1,
  "metadata": {
    "timestamp": "2023-02-21T16:09:46Z",
    "tools": [
      {
        "name": "sbom4python",
        "version": "0.8.0"
      }
    ],
    "component": {
      "type": "application",
      "bom-ref": "CDXRef-DOCUMENT",
      "name": "Python-click"
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "1-click",
      "name": "click",
      "version": "8.1.3",
      "supplier": {
        "name": "Armin Ronacher",
        "contact": [
          {
            "email": "armin.ronacher@active-4.com"
          }
        ]
      },
      "cpe": "cpe:2.3:a:armin_ronacher:click:8.1.3:*:*:*:*:*:*:*",
      "description": "Composable command line interface toolkit",
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "url": "https://opensource.org/licenses/BSD-3-Clause"
          }
        }
      ],
      "externalReferences": [
        {
          "url": "https://palletsprojects.com/p/click/",
          "type": "other",
          "comment": "Home page for project"
        }
      ],
      "purl": "pkg:pypi/click@8.1.3"
    }
  ],
  "dependencies": [
    {
      "ref": "CDXRef-DOCUMENT",
      "dependsOn": [
        "1-click"
      ]
    }
  ]
}The following command will audit the contents of the SBOM.sbomaudit--input-fileclick.json
╭─────────────────────╮
│SBOMFormatSummary│
╰─────────────────────╯[x]SBOMFormat
╭─────────────────╮
│PackageSummary│
╰─────────────────╯[x]PackageSummary
╭───────────────────────╮
│RelationshipsSummary│
╰───────────────────────╯[x]RelationshipSummary
╭──────────────╮
│NTIASummary│
╰──────────────╯[x]NTIASummary
╭────────────────────╮
│SBOMAuditSummary│
╰────────────────────╯[x]Checkspassed11[x]Checksfailed0A verbose report and summary of the contents of the SBOM to the console.sbomaudit--input-fileclick.json--verbose--cpecheck--purlcheck
╭─────────────────────╮
│SBOMFormatSummary│
╰─────────────────────╯[x]UptodateCycloneDXVersion[x]SBOMCreatoridentified[x]SBOMCreationtimedefined
╭─────────────────╮
│PackageSummary│
╰─────────────────╯[x]Supplierincludedforpackageclick[x]Versionincludedforpackageclick[x]Licenseincludedforpackageclick[x]SPDXCompatibleLicenseidincludedforpackageclick[x]OSIApprovedlicenseforclick[x]Non-deprecatedlicenseforclick[x]Usinglatestversionofpackageclick[x]Usingmatureversionofpackageclick[x]Usingoldversionofpackageclick[x]CPEnameincludedforpackageclick[x]PURLincludedforpackageclick[x]PURLnamecompatiblewithpackageclick[x]NTIAcompliant
╭───────────────────────╮
│RelationshipsSummary│
╰───────────────────────╯[x]DependencyrelationshipsprovidedforNTIAcompliance[x]Dependencyrelationshipfoundforclick
╭──────────────╮
│NTIASummary│
╰──────────────╯[x]NTIAconformant
╭────────────────────╮
│SBOMAuditSummary│
╰────────────────────╯[x]Checkspassed19[x]Checksfailed0The following is an example of the output which is generated
when some checks on the contents of the SBOM fail.╭─────────────────────╮
│SBOMFormatSummary│
╰─────────────────────╯[x]SBOMFormat
╭─────────────────╮
│PackageSummary│
╰─────────────────╯[]Usinglatestversionofpackageblack:Versionis22.12.0;latestis23.1.0[]Usinglatestversionofpackagemypy-extensions:Versionis0.4.3;latestis1.0.0[]SPDXCompatibleLicenseidincludedforpackagepathspec:MPL2.0[]Usinglatestversionofpackagepathspec:Versionis0.10.3;latestis0.11.0[]Licenseincludedforpackageplatformdirs:MISSING[]SPDXCompatibleLicenseidincludedforpackageplatformdirs:NOASSERTION[]Usinglatestversionofpackageplatformdirs:Versionis2.6.2;latestis3.0.0[]CPEnameincludedforpackageplatformdirs:MISSING[]Licenseincludedforpackagetomli:MISSING[]SPDXCompatibleLicenseidincludedforpackagetomli:NOASSERTION[]NTIAcompliant:FAILED
╭───────────────────────╮
│RelationshipsSummary│
╰───────────────────────╯[x]RelationshipSummary
╭──────────────╮
│NTIASummary│
╰──────────────╯[]NTIAconformant:FAILED
╭────────────────────╮
│SBOMAuditSummary│
╰────────────────────╯[x]Checkspassed42[x]Checksfailed12Output File FormatThe output file is in JSON format. The content depends on the contents of the SBOM and the specified command line options.sbomaudit--input-fileclick.json--verbose--output-fileclick_analysis.jsonAs the--verboseoption is specified, the resulting JSON file contains the results of all the checks which have been performed.{"metadata":[{"text":"Up to date SPDX Version","state":"Pass"},{"text":"SBOM Creator identified","state":"Pass"},{"text":"SBOM Creation time defined","state":"Pass"}],"packages":[{"name":"click","version":"8.0.3","reports":[{"text":"Supplier included for package click","state":"Pass"},{"text":"Version included for package click","state":"Pass"},{"text":"License included for package click","state":"Pass"},{"text":"SPDX Compatible License id included for package click","state":"Pass"},{"text":"OSI Approved license for click","state":"Pass"},{"text":"Non-deprecated license for click","state":"Pass"},{"text":"Using latest version of package click: Version is 8.0.3; latest is 8.1.6","state":"Fail"},{"text":"Using mature version of package click","state":"Pass"},{"text":"Using old version of package click","state":"Pass"}]}],"relationships":[{"text":"Dependency relationships provided for NTIA compliance","state":"Pass"},{"text":"Dependency relationship found for click","state":"Pass"}],"summary":[{"text":"NTIA Summary","state":"Pass"},{"text":"Checks passed 15","state":"Pass"},{"text":"Checks failed 1","state":"Pass"}]}Return ValuesThe following values are returned:-1 indicates SBOM file not specified0 indicates NTIA compliance has failed1 indicates NTIA compliance has passedLicenseLicensed under the Apache 2.0 License.LimitationsThe tool has the following limitations:The latest version checks are only performed on Python modules available on thePython Package Index (PyPi).Invalid SBOMs will result in unpredictable results.Feedback and ContributionsBugs and feature requests can be made via GitHub Issues.