ShiftSBOM-Utils

ShiftSBOM-Utils is a pure client-side Bitbucket Pipe containing a collection of open source tools to perform various types of additionl analysis on a CycloneDX or SPDX sBOM (Software Bill of Materials). No subscriptions, server access, or API keys are required.

The official copy this project is hosted on Bitbucket. In order to reach a diverse audience a copy of the repo also exists in GitHub. Pull Requests should be submitted to the to the Bitbucket reposiotry and changes will be kept in sync.

Existing toolset and roadmap

The following tooling/functionally is currently available in this pipe

Current Tools

Future Tools & Featurs

To requrst other tooling/features or to vote to have a specific tool/feature integreted next, open an issue

YAML Definition

The following is an example of a Bitbucket Pipeline which performs the following:

1. Installes dependencies for a npm project
2. Produces a sBOM via cyclonedx-npm-pipe or cyclonedx-bitbucket-pipe
3. Uses sbom-utilities-pipe to furter process the sBOM

In the following example the sbom-utilities-pipe scans the sBOM for vulnerabilities using devops-kung-fu/bomber then scans the sbom to generate a quality score using interlynk-io/sbomqs. The following code snip would need to be added to the bitbucket-pipelines.yml file

pipelines:
  default:
    - step:
        name: Build and Test
        caches:
          - node
        script:
          - npm install
          - npm test
    - step:
        name: Gen CycloneDX sBom
        caches:
          - node
        script:
          # the build directory is owned by root but the pipe runs as the bitbucket-user
          # change the permission to allow the pipe to write to the build directory
          - chmod 777 build
          - pipe: docker://ccideas/cyclonedx-npm-pipe:1.5.0
            variables:
              IGNORE_NPM_ERRORS: 'true' # optional
              NPM_SHORT_PURLS: 'true' # optional
              NPM_OUTPUT_FORMAT: 'json' # optional
              NPM_PACKAGE_LOCK_ONLY: 'false' # optional
              OUTPUT_DIRECTORY: 'build' # optional # this dir should be archived by the pipeline
        artifacts:
          - build/*
  - step:
      name: Process sBOM
      script:
        # the build directory is owned by root but the pipe runs as the bitbucket-user
        # change the permission to allow the pipe to write to the build directory
        - chmod 777 build
        - pipe: docker://ccideas/sbom-utilities-pipe:1.7.0
          variables:
            PATH_TO_SBOM: "build/${BITBUCKET_REPO_SLUG}.json"
            OUTPUT_DIRECTORY: 'build'
            # bomber config
            SCAN_SBOM_WITH_BOMBER: 'true'
            BOMBER_OUTPUT_FORMAT: 'html'
            BOMBER_DEBUG: 'true'
            # sbomqs config
            SCAN_SBOM_WITH_SBOMQS: 'true'
            SBOMQS_OUTPUT_FORMAT: 'json'
            # osv config
            SCAN_SBOM_WITH_OSV: 'true'
            OSV_OUTPUT_FORMAT: 'json'
            # grype config
            SCAN_SBOM_WITH_GRYPE: 'true'
            GRYPE_ARGS: '--output table --add-cpes-if-none'
            GRYPE_OUTPUT_FILENAME: 'grype-scan-results.txt'
            # OWASP Dependency Track
            SEND_SBOM_TO_DTRACK: 'true'
            DTRACK_URL: '<<DTRACK URL: ie - http://url:port>>'
            DTRACK_PROJECT_ID: '<<DTRACK PROJECT ID>>'
            DTRACK_API_KEY: '<<DTRACK API KEY>>'
        artifacts:
          - build/*

Variables

Support for OWASP Dependency Track

As of release 1.5.0 the sbom-utilities-pipe allows you to simpily send your CycloneDX sBOM to a OWASP Dependency track server for further analysis. The sbom-utilities-pipe uses dependency tracks /v1/bom PUT API for the request. To use this feature it is recommended you configure the following variables as secured repository variables in your Bitbucket project configuration.

DTRACK_URL DTRACK_PROJECT_ID DTRACK_API_KEY

Then configure your bitbucket-pipelines.yml with the following

- step:
      name: Process sBOM
      script:
        # the build directory is owned by root but the pipe runs as the bitbucket-user
        # change the permission to allow the pipe to write to the build directory
        - chmod 777 build
        - pipe: docker://ccideas/sbom-utilities-pipe:1.5.0
          variables:
            SEND_SBOM_TO_DTRACK: 'true'
            DTRACK_URL: ${DTRACK_URL}
            DTRACK_PROJECT_ID: ${DTRACK_PROJECT_ID}
            DTRACK_API_KEY: ${DTRACK_API_KEY}

Once the API call is successful the response ID will be logged as such

Response Body: {"token":"9ad9d8f9-273f-4d99-ae16-8fc89c21cd4d"}

Need an sBOM

This project contains some sample sBOMs which can be found in the examples/sboms directory. To produce a sBOM for a given project you can use any of the following Bitbucket Pipes

• cyclonedx-npm-pipe
• cyclonedx-bitbucket-pipe
• syft-bitbucket-pipe

Live Example

A working pipeline for the popular auditjs tool has been created as an example. The pipeline in this fork of the auditjs tool will install the required dependencies then generate a CycloneDX sBOM containing all the ingredients which make up the product then the sBOM will be further processed by the sbom-utilities-pipe

• Repository Link
• Link to bitbucket-pipelines.yml
• Link to pipeline

Support

If you’d like help with this pipe, or you have an issue, or a feature request, let us know.

If you are reporting an issue, please include:

the version of the pipe relevant logs and error messages steps to reproduce

Credits

This Bitbucket pipe is a collection and integration of the following open source tools

• bomber
• interlynk-io/sbomqs
• osv-scanner
• grype
• OWASP Dependency Track

A big thank-you to the teams and volunteers who make these amazing tools available