[Open Source] A CLI tool for generating software bills of materials (SBOMs) for software projects across multiple dimensions

Open SourceClassification Systems

2026-06-28 08:43 6 次浏览 • 0 次下载 0KB

[Open Source] A CLI tool for generating software bills of materials (SBOMs) for software projects across multiple dimensions

1. Project Overview

SBOM-TOOL

SBOM-TOOL is a CLI tool that generates Software Bills of Materials (SBOM) for software projects using information from multiple dimensions, including source code repositories, code fingerprints, build environments, artifact information, artifact contents, and dependencies.

2. Open Source License

Using MulanPSL-2.0 open source protocol

3. Screenshots

4. Feature Overview

Functional characteristics

Information Collection

Collect source code project information, including repository URLs, version information, and more.
Collect and generate code fingerprints using specific algorithms.
Collect project build dependency environment information, including operating systems, kernels, compilers, build tools, and more.
Collect project build dependencies, supporting dependency collection across multiple programming languages and package managers.
Collect final artifact package information, including package names, types, unique checksums, and more.
Collect artifact content information, including file names, types, unique checksums, and more.

SBOM Documents

Assemble standard SBOM documents based on the information collected above.
Standard format conversion: Supports XSPDX, SPDX, and other standards, as well as formats such as JSON.
Standard format validation: Supports XSPDX, SPDX, and other standards, as well as formats such as JSON.

Code Fingerprint Generation

Development Language	Supported?
C/C++	Yes
Java	Yes
C#	Yes
Dart	Yes
Golang	Yes
Javascript	Yes
Objective-C	Yes
Php	Yes
Python	Yes
Ruby	Yes
Rust	Yes
Swift	Yes
Lua	Yes

Dependency Package Scanning

The following programming language configuration file parsing and binary package parsing capabilities are currently supported. Support for additional programming languages will be added gradually.

Package Type	Package Manager	Parsing Files	Dependency Graph Supported
maven	Maven	pom.xml .jar .war [graph]maven-dependency-tree.txt(mvn dependency:tree -DoutputFile=maven-dependency-tree.txt)	Yes
maven	Gradle	*.gradle .gradle.lockfile [graph]gradle-dependency-tree.txt(gradlew gradle-baseline-java:dependencies > gradle-dependency-tree.txt)	Yes
conan	Conan	conanfile.txt conan.lock [graph]conan-graph-info.json(conan graph info -f json > conan-graph-info.json)	Yes
npm	NPM	package.json package-lock.json	No
npm	Yarn	[graph]yarn.lock	Yes
npm	PNPM	[graph]pnpm.lock	Yes
golang	Go Module	go.mod Go Binary file [graph]go-mod-graph.txt(go mod graph > go-mod-graph.txt)	Yes
golang	Glide	glide.yml glide.yaml	No
golang	GoDep	Godeps.json	No
golang	Dep	Gopkg.toml	No
golang	GVT	*/vendor/manifest	No
pypi	PIP	Pipfile.lock dist-info/METADATA PKG-INFO requirements*.txt setup.py [graph]pipenv-graph.txt(pipenv graph > pipenv-graph.txt)	Yes
pypi	Poetry	[graph]poetry.lock	Yes
conda	Conda	environment.yml environment.yaml package-list.txt	No
composer	Composer	composer.json composer.lock	No
cargo	Cargo	Cargo.toml [graph]Cargo.lock Rust Binary file	Yes
carthage	Carthage	Cartfile Cartfile.resolved	No
swift	SwiftPM	Package.swift	No
cocoapods	Cocoapods	Podfile.lock Podfile *.podspec	Yes
gem	Gem	[graph]Gemfile.lock Gemfile *.gemspec	Yes
nuget	NuGet	[graph].deps.json .csproj .vbproj .fsproj .vcproj .nuget.dgspec.json *.nuspec packages.json packages.lock.json	Yes
pub	Pub	[graph]pub-deps.json(dart pub deps --json > pub-deps.json) pubspec.lock pubspec.yaml	Yes
rpm	RPM	*.spec	No
lua	LuaRocks	*.rockspec	No
bower	Bower	*.spec	No

5. Tech Stack

Software Architecture

Download and Install

1. Download and Compile the Source Code (Requires Go 1.18 or Later)

Visit Yifei Open Source: https://code.exmay.com/ Download
cd sbom-tool
make

By default, executable binaries are generated for multiple system architectures.

Linux X86_64：sbom-tool-linux-amd64
Linux arm64：sbom-tool-linux-arm64
Windows X86_64：sbom-tool-windows-amd64.exe
Windows arm64：sbom-tool-windows-arm64.exe
MacOS amd64: sbom-tool-darwin-amd64
MacOS arm64: sbom-tool-darwin-arm64

Subcommand Reference

Subcommand	Function
help	Tool Help Manual
artifact	Collect software package artifact information
assembly	Assemble documents generated at each stage into an SBOM document
completion	Generate an autocompletion script for the specified shell
convert	Convert the SBOM document format
env	Generate environment information
generate	Generate an SBOM document
package	Collect package dependencies
source	Collect source code information
validate	Validate the SBOM document format
info	Retrieve tool introduction information
modify	Modify SBOM document properties

Parameter Description

Parameters	Short Option	Description	Usage examples
--log-level		Specify the log level, including debug, info, warn, and error	--log-level info
--log-path		Specify the log path. By default, a log directory and log file are automatically generated under the user's home directory ($home/sbom-tool/sbom-tool.log).	--log-path /tmp/sbom.log
--quiet	-q	Disable console output	--quiet -q
--ignore-dirs		Directories to ignore. Skip all dot directories. Separate entries with commas. Example: NODE_MODULES,LOGS	--ignore-dirs log,logs
--language	-l	Specify the language (currently supported: java, cpp; default: "*")	--language java -l cpp
--parallelism	-m	Concurrency level (default: 8)	--parallelism 4 -m 9
--output	-o	Specify the path and filename for the output file. By default, it is automatically generated in the current directory.	--output /tmp/sbom.json
--src	-s	Specify the source code directory (defaults to the current directory)	--src /tmp/sbomtool/src/
--path	-p	Specify the project root directory; in the assembly subcommand, this specifies the temporary document directory for each stage.	--path /tmp/sbomtool/
--dist	-d	Specify the artifact directory (defaults to the current directory)	--dist /tmp/sbomtool/bin/
--format	-f	Specify the SBOM document format (currently supported: xspdx-json, spdx-json, spdx-tagvalue; default: spdx-json)	--format spdx-json -f spdx-json
--input	-i	Specify the SBOM document as input	--input /tmp/sbom.jsom
--algorithm	-a	Specify the algorithm used to generate the SBOM document identifier (currently supported: SHA1, SHA256, SM3; default: SM3)	--algorithm SHA256

SBOM Document Standards and Formats

Standard	Type	SBOM Document Format	Supported?
XSPDX	JSON	xspdx-json	Supported
SPDX	JSON	spdx-json	Supported
SPDX	TagValue	spdx-tagvalue	Supported

XSPDX is an SBOM format specification based on an extension of SPDX

Usage Examples

Generate SBOM documents and specify the format

sbom-tool generate -m 4 -p ${project_path} -s ${src_path} -d ${dist_path}  -o sbom.spdx.json -f spdx-json --ignore-dirs .git  -n ${name} -v ${version} -u ${supplier} -b ${namespace}

Retrieve tool introduction information

sbom-tool info

For more usage examples, see the documentation

Development guide

See the Developer Guide for details

下载地址免费

#1

资源直链https://gitee.com/JD-opensource/sbom-tool

去下载