SBOM, It’s Not Hard Anymore! 🤯 Easily Create SBOMs with the bom Command

Hello! 👋 Today, I’d like to talk about the core of software supply chain security! SBOM (Software Bill of Materials), and introduce a fantastic tool called bom that allows you to quickly create an SBOM with a single command in the terminal.

📜 What exactly is SBOM?

When we buy a bag of snacks, the ingredients list on the back meticulously details what went into it, right? SBOM is precisely the ingredient list for software.

It’s a specification that contains a list of all open-source libraries, frameworks, modules, etc., used to build your application, along with their versions and license information. With recent incidents like the Log4j vulnerability causing significant ripple effects, the importance of SBOM in understanding what components are in the software you use is growing day by day. 🛡️

However… when you actually try to create an SBOM, it can feel daunting. You might wonder, ‘How do I find all the dependencies in my project?’ This is where a hero comes to our rescue! ✨

✨ Kubernetes’ Chosen SBOM Tool, the bom Command!

bom is an open-source SBOM generation tool being developed by Kubernetes’ SIG-Release (Release Management Group). It helps you easily generate SBOMs from various targets like source code directories, container images, and more, with simple commands and no complex configurations.

Key Advantages of bom!

• 🚀 Simple and Fast: Installation and usage are incredibly simple, so anyone can get started right away.
• 🌐 Standard Format Support: It supports both major SBOM formats, SPDX and CycloneDX, allowing easy integration with other security tools.
• 💪 Versatile: It can generate SBOMs not only for source code directories but also for container images like Docker, and even single files.

🛠️ Shall we start with bom installation?

bom can be installed in various ways. Choose the most convenient method!

1. Using Homebrew (macOS/Linux) 🍺 This is the simplest method. Just type the command below in your terminal, and installation is complete!

brew install bom

2. Install with Go Language 🐹 If Go is installed, you can install it with the command below.

go install sigs.k8s.io/bom/cmd/bom@latest

3. Download Release Binaries 💻 You can also directly download and use the binary file suitable for your operating system from the official GitHub releases page.

Once installed, verify successful installation by checking the version in your terminal!

bom version

👨‍💻 Now, let’s create an SBOM ourselves! (Core Usage)

bom usage is very intuitive. Let’s explore two of the most common scenarios.

Scenario 1: Generating SBOM from a Source Code Directory 📂

This is the most common case: analyzing a directory containing project source code to create an SBOM.

Basic Usage Navigate to your project’s root directory and run the command below.

# Generate SBOM by analyzing the current directory (.)
bom generate -d .

Then, you’ll see a list of packages your project depends on scrolling through the terminal.

Saving to a file in a standard format Instead of terminal output, it’s common to save to a file in a standard format (SPDX or CycloneDX). You can use the -f or –format option.

# Generate SBOM file in SPDX format (JSON)
bom generate -d . -f spdx-json > bom.spdx.json

# Generate SBOM file in CycloneDX format (JSON)
bom generate -d . -f cyclonedx-json > bom.cdx.json

The generated bom.spdx.json or bom.cdx.json file can then be fed into security scanners or uploaded to asset management systems. 📝

Scenario 2: Generating SBOM from a Container Image 🚢

In DevOps environments, understanding the components of a container image is crucial. bom starts analysis immediately if you just provide the image name.

Basic Usage Use the -i or –image option to specify the container image you want to analyze.

# Analyze official nginx:latest image
bom generate -i nginx:latest

Saving to a file in a standard format Similarly, you can save to a file using the -f option.

# Save SBOM of nginx image in CycloneDX format
bom generate -i nginx:latest -f cyclonedx-json > nginx-sbom.cdx.json

Now you can transparently peek inside your container images to see what software packages are installed! 🔍

✅ Conclusion

The first step in software supply chain security begins with knowing what you are using. SBOM is no longer just for experts. Thanks to excellent tools like bom, all of us can now easily create and manage our project’s ingredient lists.

Why not apply bom to your project right now to identify hidden dependencies and build safer software?

For more detailed information, visit the official bom GitHub repository!

---

Tags: SBOM, Software Bill of Materials, bom, CLI, Security, DevSecOps, Kubernetes, Open Source, CycloneDX, SPDX, Software Supply Chain Security