Package: ws-sbom-generator
Mend SBOM GeneratorThis tool generates SBOM reports in eitherSPDXorCycloneDXformats, for specified projects.The tool can be executed either viaCLIor as aDocker container.Note:This tool utilizes a forked package ofspdx-tools.SBOM Generator CLISupported Operating SystemsLinux (Bash):CentOS, Debian, Ubuntu, RedHatWindows (PowerShell):10, 2012, 2016PrerequisitesPython 3.8 or laterMend user with admin permissionsNote:The specified user (-u, --userKey) must be associated with a group assigned as either Organization Administrators (for generating report for all projects in the organization) or Product Administrators. For the latter,--tokenTypemust be specified (seeCommand-Line Arguments).InstallationInstall the PyPI packagews-sbom-generatorpip install ws-sbom-generatorNote:Depending on whether the package was installed as a root user or not, you need to make sure the package installation location was added to the$PATHenvironment variable.Update thecreation infoas needed in theresource/sbom_extra.jsonfile:{"namespace":"http://CreatorWebsite/pathToSpdx/DocumentName-UUID","org_email":"org@domain.com","person":"First Last","person_email":"first.last@domain.com"}Usagews_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--type$FORMAT--out$HOME/reports--extraresources/sbom_extra.jsonCommand-Line ArgumentsParameterTypeRequiredDescription‑h, ‑‑helpswitchNoShow help and exit‑a, ‑‑wsUrlstringYesMend server URL‑u, ‑‑userKeystringYesMend User Key‑k, ‑‑tokenstringYesMend API Key or Product token‑y, ‑‑tokenTypestringNo*[organization|product*] (default:organization)‑t, ‑‑typestringNo*Report format [json|tv|rdf|xml|yaml|cdx*|all*] (default:tv)‑s, ‑‑scopestringNoProduct or Project token to generate the report(s) for. When specifying a Product token, one report will be generated for each project under that product. If not specified, one report will be generated for each project in your organization.‑o, ‑‑outstringNoOutput directory (default:$PWD)‑on, ‑‑outfilestringNo*Output file name* (default:Mend {PROJECT_NAME} SBOM report-{FORMAT})‑lt, ‑‑licensetextboolNoInclude full license text for all libraries* (default:False)‑th, ‑‑threadsintNoNumber of threads to run in parallel for report generation (default:10)‑e, ‑‑extrastringNo*Path to a json file containing thecreation infoto be included in the report (default:$PWD/resources/sbom_extra.jsonNotes:* Token type (--tokenType product) is required in case the specifieduserKeyis associated with a group with Product Administrators permissions.* Report type (--type)cdxwill generate a JSON file inCycloneDX v1.4format.* Report type (--type)allwill generate one file in each format for each specified project.* Output file name (--outfile) is only supported for a single project scope.* Full license texts will be taken by default from theSPDX License List. If a given license does not exist there, the tool will attempt to take it from Mend's database.* By default, the tool will use the placeholders in theresource/sbom_extra.jsonfile.Execution ExamplesGeneratingtvformatted SBOM report for a specific projectws_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--scope$WS_PROJECTTOKEN--out$HOME/reports--extrasbom_extra.jsonGeneratingtvformatted SBOM report for all projects of a specified productws_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--scope$WS_PRODUCTTOKEN--out$HOME/reports--extrasbom_extra.jsonGeneratingjsonformatted SBOM report for all projects in the organizationws_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--typejson--out$HOME/reportsGeneratingjsonformatted SBOM report for all projects in the organization, including full license textws_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--typejson--out$HOME/reports--licensetextTrueGeneratingxmlformatted SBOM report for a single project (executed by a product administrator)ws_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_PRODUCTTOKEN--tokenTypeproduct--scope$WS_PROJECTTOKEN--typexml--out$HOME/reports--extrasbom_extra.jsonGeneratingjsonformatted SBOM report for a single project, specifying file namews_sbom_generator--wsUrl$WS_WSS_URL--userKey$WS_USERKEY--token$WS_APIKEY--scope$WS_PROJECTTOKEN--typejson--out$HOME/reports--extrasbom_extra.json--outfilemy-project-sbom.jsonSBOM Generator Docker ContainerSupported Operating SystemsLinux:CentOS, Debian, Ubuntu, RedHatWindows:10, 2012, 2016PrerequisitesDocker version 20 or laterMend user with admin permissionsNote:The specified user (-u, --userKey) must be associated with a group assigned as either Organization Administrators (for generating report for all projects in the organization) or Product Administrators. For the latter,--tokenTypemust be specified (seeCommand-Line Arguments).Installationdockerpullwhitesourcetools/ws-sbom-generator:latestUsagedockerrun--namews-sbom-generator\-v$HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom-generator/resources\-v$HOME/reports:/opt/ws-sbom-generator/sbom-generator/output\-eWS_URL=$WS_WSS_URL\-eWS_USER_KEY=$WS_USERKEY\-eWS_TOKEN=$WS_APIKEY\-eWS_REPORT_TYPE=<REPORT_TYPE>\whitesourcetools/ws-sbom-generatorExecution ExamplesRunning as organization administrator, generatingjsonformatted SBOM reports for all projects, default extra argsdockerrun--namews-sbom-generator\-v$HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources\-v$HOME/reports:/opt/ws-sbom-generator/sbom_generator/output\-eWS_URL=$WS_WSS_URL\-eWS_USER_KEY=$WS_USERKEY\-eWS_TOKEN=$WS_APIKEY\-eWS_REPORT_TYPE=jsonwhitesourcetools/ws-sbom-generatorRunning as organization administrator, generatingtvformatted SBOM report for a single project, default extra argsdockerrun--namews-sbom-generator\-v$HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources\-v$HOME/reports:/opt/ws-sbom-generator/sbom_generator/output\-eWS_URL=$WS_WSS_URL\-eWS_USER_KEY=$WS_USERKEY\-eWS_TOKEN=$WS_APIKEY\-eWS_SCOPE_TOKEN=<WS_PROJECT_TOKEN>\whitesourcetools/ws-sbom-generatorRunning as a product administrator, generatingrdfformatted SBOM report for a single project, default extra argsdockerrun--namews-sbom-generator\-v$HOME/ws-sbom-generator/resources:/opt/ws-sbom-generator/sbom_generator/resources\-v$HOME/reports:/opt/ws-sbom-generator/sbom_generator/output\-eWS_URL=$WS_WSS_URL\-eWS_USER_KEY=$WS_USERKEY\-eWS_TOKEN=$WS_PRODUCTTOKEN\-eWS_TOKEN_TYPE=product-eWS_SCOPE_TOKEN=$WS_PROJECTTOKEN\whitesourcetools/ws-sbom-generator