Skip to content

creating-cbomkit-cbom.md

Latest commit

 

History

History
125 lines (92 loc) · 3.83 KB

creating-cbomkit-cbom.md

File metadata and controls

125 lines (92 loc) · 3.83 KB

Creating CBOMs Using the IBM Cbomkit Application

Introduction

This tutorial illustrates how to create a cryptography bill of materials (CBOM) from git projects using the IBM CBOMkit application.

Requirements

  • git
  • docker-compose

Installation

Install CBOMkit by cloning its repository by running the following:

git clone https://github.com/IBM/cbomkit

Navigate and initiate the application by running:

cd cbomkit
make production

Navigate to http://localhost:8001 on your browser. You should see a page akin to the following:

homepage

Usage

To create a CBOM, navigate to the "Generate a new CBOM" section:

generate

Then, paste the URL of the git repo in question. Then, click "Scan".

Advanced settings are accessed via clicking the "Advanced options" checkbox. The advanced options are:

  • Scan: Where specific branches and folders can be specified.

    scan

  • Authentication: Where repo authentication can be specified via username and password or through a personal access token (PAT).

    authenticate

After the scan is completed, the output will look similar to the following:

result

To download the created CBOM, navigate to the "Download CBOM" button on the right hand side and click on it:

download

The generated cbom.json file will be downloaded to your system's default downloads folder.

Notes

  • The requirement docker-compose is separate to the subcommand, docker compose.

Example SBOM

The following section illustrates a CycloneDX Cryptographic Bill of Materials (CBOM) of the keycloak codebase, created with IBM CBOMkit.

<title>Pretty JSON Display</title> <style> #json-container { height: 400px; /* Set a fixed height */ overflow-y: auto; /* Enable vertical scrolling */ border: 2px solid #ccc; /* Optional: add a border for visibility */ padding: 10px; } #xml-container { height: 400px; /* Set a fixed height */ overflow-y: auto; /* Enable vertical scrolling */ border: 2px solid #ccc; /* Optional: add a border for visibility */ padding: 10px; } pre { margin: 0; white-space: pre-wrap; word-wrap: break-word; } </style>

keycloak 


    

    <script>
        function display_json(url, elementid){
        fetch(url)
            .then(response => response.json())
            .then(data => {
                document.getElementById(elementid).textContent = JSON.stringify(data, null, 2);
            })
            .catch(error => console.error('Error fetching JSON:', error));
        }
        function display_xml(url, elementid){
        fetch(url)
            .then(response => response.text())
            .then(data => {
                document.getElementById(elementid).textContent = data;
            })
            .catch(error => console.error('Error fetching XML:', error));
        }
    display_json('./cbom.json', 'json-display');
    </script>



References