sbom tool cycloneDX #3959
Open
sbom tool cycloneDX #3959
+93
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
memsharded
reviewed
Jan 23, 2025
There was a problem hiding this comment.
It is looking good, a couple of small additions:
- Adding the
conanfile.subgraphdocs somewhere, as experimental too - Adding a small example with a hook using the
.subgraph.serialize()to serialize the conan graph.json. It can be done also to put it inside the binary package metadata folder in the same way as the cyclonedx. It can be a parallel section to theCycloneDXone, calledConan - Remind somewhere that the contents of the files are also subject to modifications and evolution, they might change in future version
| json.dump(sbom_cyclonedx_1_4, f, indent=4) | ||
| ConanOutput().success(f"CYCLONEDX CREATED - {conanfile.generators_folder}") | ||
|
|
||
|
|
There was a problem hiding this comment.
Lets add a small reference section for the cyclonedx_1_4() function.
AbrilRBS
approved these changes
Jan 23, 2025
| Let's look at two examples: | ||
|
|
||
| In the first one, we have the case where we want to generate the SBOM at the moment we create our app, after the | ||
| package method. This is very useful for keeping track of the components and dependencies of our software. |
There was a problem hiding this comment.
Suggested change
| package method. This is very useful for keeping track of the components and dependencies of our software. | |
| package method. This is very useful for keeping track of the components and dependencies of that went into building our software. |
| import os | ||
| from conan.api.output import ConanOutput | ||
| from conan.tools.sbom.cyclonedx import cyclonedx_1_4 | ||
| def post_package(conanfile): |
There was a problem hiding this comment.
Suggested change
| def post_package(conanfile): | |
| def post_package(conanfile, **kwargs): |
Most hook examples should have this so that in the future we can more easily update their signature if it's ever needed
| import os | ||
| from conan.api.output import ConanOutput | ||
| from conan.tools.sbom.cyclonedx import cyclonedx_1_4 | ||
| def post_generate(conanfile): |
There was a problem hiding this comment.
Suggested change
| def post_generate(conanfile): | |
| def post_generate(conanfile, **kwargs): |
| os.mkdir(os.path.join(generators_folder, "sbom")) | ||
| with open(os.path.join(generators_folder, "sbom", file_name), 'w') as f: | ||
| json.dump(sbom_cyclonedx_1_4, f, indent=4) | ||
| ConanOutput().success(f"CYCLONEDX CREATED - {conanfile.generators_folder}") |
There was a problem hiding this comment.
Maybe a comment that both hooks are outputting their sbom in different places?
| import json | ||
| import os | ||
| from conan.api.output import ConanOutput | ||
| def post_package(conanfile): |
There was a problem hiding this comment.
Suggested change
| def post_package(conanfile): | |
| def post_package(conanfile, **kwargs): |
|
|
||
| Instead of using a standard, we can take a Conan-based approach. Thanks to the ``conanfile.subgraph.serialize()`` | ||
| function, we can directly obtain information about the dependencies of our program. | ||
| In the following example, we can see a hook that generates this simplified SBOM. |
There was a problem hiding this comment.
Suggested change
| In the following example, we can see a hook that generates this simplified SBOM. | |
| In the following example, we can see a hook that generates a simplified SBOM | |
| consisting of the serialization of the subgraph, which includes all data Conan has | |
| about the specific dependencies. |
or something like this, as I don't think either method is too documented right now
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
conan-io/conan#17559