gnodet-bot commented on code in PR #26468: URL: https://github.com/apache/camel/pull/26468#discussion_r4014415514
########## docs/user-manual/modules/ROOT/pages/sbom.adoc: ########## @@ -86,6 +86,90 @@ SBOM before building with `mvn quarkus:dependency-sbom`. == Analyzing SBOMs -Once generated, an SBOM can be fed into vulnerability scanners and compliance tools. -For example, https://dependencytrack.org/[OWASP Dependency-Track] can ingest CycloneDX SBOMs -and continuously monitor for known CVEs across your dependency tree. +Once you have a CycloneDX SBOM — a released Camel SBOM from the link:/download/[download page], +the aggregate SBOM kept in the source tree under `camel-sbom/`, or one you generated for your own +application — you can feed it into vulnerability scanners, license and policy tools, and +continuous-monitoring platforms. Because the SBOM already captures the resolved dependency graph, +these tools work from the file alone: no rebuild or re-resolution of the project is required. + +The examples below assume a CycloneDX JSON file named `camel-sbom.json`; substitute the file you +actually have (for a release, e.g. `camel-4.23.0-sbom.json`). + +=== Scanning for known vulnerabilities + +Several open source scanners read a CycloneDX SBOM directly and match its components against +vulnerability databases: + +[source,bash] +---- +# Anchore Grype +grype sbom:camel-sbom.json + +# Aqua Trivy +trivy sbom camel-sbom.json + +# Google OSV-Scanner (v2) +osv-scanner scan source -L camel-sbom.json +---- + +TIP: OSV-Scanner auto-detects CycloneDX files whose name is `bom.json` / `bom.xml` or ends in +`.cdx.json` / `.cdx.xml`. For any other name, point it at the file explicitly with `-L` as above. + +=== Inspecting, validating and converting + +The https://github.com/CycloneDX/cyclonedx-cli[CycloneDX CLI] validates, converts and diffs BOMs. +Camel's SBOMs use CycloneDX specification version 1.6, and the CLI's `validate` defaults to a newer +schema version, so pass `--input-version v1_6` explicitly: + +[source,bash] +---- +# Validate against the CycloneDX 1.6 schema +cyclonedx validate --input-file camel-sbom.json --input-format json --input-version v1_6 --fail-on-errors + +# Convert JSON to XML (use --output-format spdxjson to convert to SPDX) +cyclonedx convert --input-file camel-sbom.json --output-file camel-sbom.xml Review Comment: 💡 **Nit:** The `convert` command omits `--output-format xml` and relies on auto-detection from the `.xml` extension — which works in practice, but is inconsistent with the `validate` example just above that passes `--input-format json` explicitly. Worth being explicit for clarity: ```suggestion cyclonedx convert --input-file camel-sbom.json --output-format xml --output-file camel-sbom.xml ``` ########## docs/user-manual/modules/ROOT/pages/sbom.adoc: ########## @@ -86,6 +86,90 @@ SBOM before building with `mvn quarkus:dependency-sbom`. == Analyzing SBOMs -Once generated, an SBOM can be fed into vulnerability scanners and compliance tools. -For example, https://dependencytrack.org/[OWASP Dependency-Track] can ingest CycloneDX SBOMs -and continuously monitor for known CVEs across your dependency tree. +Once you have a CycloneDX SBOM — a released Camel SBOM from the link:/download/[download page], +the aggregate SBOM kept in the source tree under `camel-sbom/`, or one you generated for your own +application — you can feed it into vulnerability scanners, license and policy tools, and +continuous-monitoring platforms. Because the SBOM already captures the resolved dependency graph, +these tools work from the file alone: no rebuild or re-resolution of the project is required. + +The examples below assume a CycloneDX JSON file named `camel-sbom.json`; substitute the file you +actually have (for a release, e.g. `camel-4.23.0-sbom.json`). + +=== Scanning for known vulnerabilities + +Several open source scanners read a CycloneDX SBOM directly and match its components against +vulnerability databases: + +[source,bash] +---- +# Anchore Grype +grype sbom:camel-sbom.json + +# Aqua Trivy +trivy sbom camel-sbom.json + +# Google OSV-Scanner (v2) +osv-scanner scan source -L camel-sbom.json +---- + +TIP: OSV-Scanner auto-detects CycloneDX files whose name is `bom.json` / `bom.xml` or ends in +`.cdx.json` / `.cdx.xml`. For any other name, point it at the file explicitly with `-L` as above. + +=== Inspecting, validating and converting + +The https://github.com/CycloneDX/cyclonedx-cli[CycloneDX CLI] validates, converts and diffs BOMs. +Camel's SBOMs use CycloneDX specification version 1.6, and the CLI's `validate` defaults to a newer +schema version, so pass `--input-version v1_6` explicitly: + +[source,bash] +---- +# Validate against the CycloneDX 1.6 schema +cyclonedx validate --input-file camel-sbom.json --input-format json --input-version v1_6 --fail-on-errors + +# Convert JSON to XML (use --output-format spdxjson to convert to SPDX) +cyclonedx convert --input-file camel-sbom.json --output-file camel-sbom.xml + +# Diff two SBOMs — e.g. what dependencies changed between two Camel releases +cyclonedx diff camel-4.22.0-sbom.json camel-4.23.0-sbom.json --component-versions +---- + +For quick, ad-hoc queries no dedicated tool is needed — the JSON can be sliced with +https://jqlang.github.io/jq/[`jq`]: + +[source,bash] +---- +# List every component as group:name:version +jq -r '.components[] | "\(.group):\(.name):\(.version)"' camel-sbom.json Review Comment: ⚠️ **Accuracy:** `.group` is optional in the CycloneDX spec — it's reliably present in Maven-generated SBOMs (like Camel's), but absent for components from npm, pip, Go, and similar ecosystems. A user running this against a non-Maven SBOM will get `:name:version` for every component without a group. Use `// ""` as a fallback: ```suggestion # List every component as group:name:version jq -r '.components[] | "\(.group // ""):\(.name):\(.version)"' camel-sbom.json ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
