CycloneDX Buildroot

This Buildroot python application generates CycloneDX Software Bill of Materials (SBOM) containing all direct dependencies of a Buildroot generated project.
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. Buildroot provides a build target named "legal-info" which produces a set of files including manifest.csv. The legal-info is a general "make" target for a Buildroot project.

Usage

By default, manifest.csv will be read from the current working directory and the resulting bom.json will also be created in the current working directory.
This can be overwritten as follows:

  
$ python3 generateBuildrootSBOM.py -i <path>/manifest.csv -n "My Project" -v "1.2.3.4" -m "company name" -c cpe.json
      Usage:  generateBom.cli [OPTIONS]
      Options:
        -i <path> - filename of the output from make legal-info, example: manifest.csv
        -o <path> - the bom file name to create
        -n name of the project or product SBOM <project name in quotes>
        -v your product SBOM version <project version in quotes>
        -m SBOM manufacturer name
        -c <path> - cpe file name from make show-info, example cpe.json

Diagram depicting where this project fits into the pipeline of secure development activities. Note that while the diagram depicts a linear sequence of activities, the entire sequence is typically cyclical. The end state of SBOM management receives the SBOM files for the product versions to properly manage the state of vulnerabilities over time.

CycloneDX Schema Support

The following table provides information on the version of this module, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this module that is compatible with the CycloneDX version supported by the target system.

Copyright & License

CycloneDX Buildroot is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.