Generate SBOM from .tar list

[Trakeur]

Hi everyone,

I was wondering if it was possible to generate an SBOM from a folder containing a list of compressed files in .tar.gz (or .tar.xz/.tar.bzip2) format.

As part of a project, we recover a large number of compressed archives and would like to synthesize them into an SBOM with as much information as possible.

This may not be possible natively, but what would you advise me to do with cdxgen? Do I need to decompress them all first? Note that these are source archives.

Thank you !

[prabhu]

@Trakeur, could you test by passing a single .tar.gz directly and see how the SBoM looks? We can iterate and make it work for multiple files once we are happy with the result.

https://github.com/CycloneDX/cdxgen/blob/master/index.js#L4353

[Trakeur]

Without specifying any type I have the following error :
Unable to extract image archive to /tmp/docker-images-p8y0vi OS BOM generation has failed due to problems with exporting the image perl-
I get the same result whether I try with a .tar or .tar.gz file.

[Trakeur]

I'll send you the details tomorrow.
But I ask what will be possible to do with cdxgen? Because the files in the tar archives all have a different structure and I don't know if we'll be able to exploit anything other than simply retrieving the name and version of the components from the archive name.

[Trakeur]

Re,
I've looked into it a bit more, but if I've understood correctly for the moment the tool is able to scan .tar files that represent a docker container, which isn't the case for me.
Our .tar files correspond to component source archives (such as perl, curl, make...).

So do you think cdxgen could exploit this kind of file, or is there no similar functionality built in at the moment?

[prabhu]

@Trakeur I can answer and assess the effort involved after accessing such an archive. Could you share or point me to a public one?

[Trakeur]

Yes, this is Perl source compressed archive: https://www.cpan.org/src/

But I'll probably go with another method, with the CycloneDX-CLI it's possible to generate SBOM from csv file. We will fill the csv manually or partially automatically.

Thank you though !

[prabhu]

@Trakeur, thank you for sharing the link. Support for c/c++ sources is in the works for later this year. I will let you know once the support is available. For now, you can track such packages manually. Some basic hash-based detection tools might be available if you look around the cyclonedx marketplace or the scancode.io ecosystem.