Welcome to apt2sbom

This package contains a library and a CLI tool to convert a Ubuntu software package inventory to a software bill of materials. You are in the wrong place if you are not running Ubuntu.

The package is under active development. Don't be surprised if something doesn't work quite right. please see CONTRIBUTING.md for details.

Building

Building is easy:

Bop the version on setup.cfg
python3 -m build -w
cd dist
pip3 install that file

Do this, of course, on a Ubuntu system.

Usage

To use the CLI tool:

% apt2sbom (--json|--yaml|--cyclonedx [--pip])

Will produce either JSON or YAML forms of an SPDX file, or the JSON form of a CycloneDX file . There is no default. Pick one.

To include python packages, add --pip.

There is also a werkzeug interface so that an SBOM file can be delivered via HTTP. To use, create a simple wsgi file as follows:

from apt2sbom.wsbom import app as application  
application = create_app(\_name\_)

and call that file from your httpd. An apache example follows:

WSGIScriptAlias /.well-known/sbom /usr/lib/cgi-bin/sbom.wsgi
WSGIPassAuthorization On

When this is done, a very simple password file is expected in /etc/sbom.users:

{
   "user" : "password",
   "otheruser" : "otherpassword",
    ...
}

The passwords aren't hashed. This is clearly something that has to be addressed in the future.

The type of SBOM returned depends on the Accepts: header sent.

Comments

A possible alternative library for apt

This is tool looking very nice... FWIW I maintain this library https://github.com/nexB/debian-inspector that has a different approach as it can deal with installed debian package in a static way e.g., even if you are not on Debian or when you are trying to get the installed packages from a tarball, or a container image. You may find it useful or entertaining!

See it used here https://github.com/nexB/scancode-toolkit/blob/1dfd73a28fed3bdd3bb6554eeda35f52fb3d86f9/src/packagedcode/debian.py#L160

opened by pombredanne 2