oscerd opened a new pull request, #26468: URL: https://github.com/apache/camel/pull/26468
## What The user manual's xref:sbom.adoc[Generating SBOMs] page ended with a two-sentence "Analyzing SBOMs" stub that only name-dropped OWASP Dependency-Track. This expands it into a practical guide for consuming a CycloneDX SBOM — whether a released Camel SBOM, the aggregate one kept under `camel-sbom/`, or one generated for a user's own app. New content in the **Analyzing SBOMs** section: - **Vulnerability scanning** from the SBOM alone (no rebuild): Anchore Grype, Aqua Trivy, Google OSV-Scanner. - **Inspecting / validating / converting / diffing** with the CycloneDX CLI, plus `jq` one-liners for ad-hoc queries. - **Continuous monitoring with OWASP Dependency-Track**: UI upload and the `POST /api/v1/bom` REST API for CI, plus what the shipped `camel-sbom.vex.json` VEX file is for. ## Command accuracy Every command was verified against current tool docs rather than from memory: - **OSV-Scanner v2** dropped the old top-level `--sbom` flag; since `camel-sbom.json` doesn't match the auto-detected `*.cdx.json` pattern, the doc uses `osv-scanner scan source -L camel-sbom.json`. - **CycloneDX CLI** `validate` defaults to a newer spec version, so the doc passes `--input-version v1_6` (Camel's SBOMs are CycloneDX 1.6). - **Dependency-Track** `/api/v1/bom` is `multipart/form-data` with `X-Api-Key`; the example uses `autoCreate`/`projectName`/`projectVersion`. Doc-only change; no code touched. Follows the existing page's link conventions (`link:/download/`, external `https://...[text]`). _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
