3 ms·
This is really helpful to diversify the current oss tools. Does anyone know good sources for creating a SBOM?
by technics256 4y ago
This is really helpful to diversify the current oss tools.
Does anyone know good sources for creating a SBOM?
- dlor 4y agoDepends exactly what you're trying to create it for. I advocate for doing it during the build process rather than as a step after. We open sourced a few tools that do it automatically for containers: https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/melange https://github.com/chainguard-dev/melange
- citruscomputing 4y agoI've used the cyclonedx maven plugin, cyclonedx-bom on pypi, cdxgen for js, and cyclonedx-cli for various utilities (e.g. merging). All have worked great.