{"id":19368478,"url":"https://github.com/anchore/sbom-examples","last_synced_at":"2025-04-23T15:30:44.067Z","repository":{"id":46379675,"uuid":"515298367","full_name":"anchore/sbom-examples","owner":"anchore","description":"Repository of SBOMs generated by the syft SBOM generator tool, against a list of popular dockerhub container images.","archived":false,"fork":false,"pushed_at":"2024-10-09T23:06:24.000Z","size":5349,"stargazers_count":17,"open_issues_count":2,"forks_count":2,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-04-02T16:50:39.370Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anchore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-07-18T18:29:48.000Z","updated_at":"2025-02-12T14:13:38.000Z","dependencies_parsed_at":"2022-08-12T12:51:46.733Z","dependency_job_id":null,"html_url":"https://github.com/anchore/sbom-examples","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fsbom-examples","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fsbom-examples/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fsbom-examples/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fsbom-examples/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anchore","download_url":"https://codeload.github.com/anchore/sbom-examples/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250460242,"owners_count":21434229,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T08:06:42.175Z","updated_at":"2025-04-23T15:30:43.637Z","avatar_url":"https://github.com/anchore.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SBOM.me\n\nWelcome to SBOM.me. This is a place to not only learn about SBOMs, but also\nstart creating and using them yourself in just a couple of minutes.\n\nThis is all hosted in GitHub, feel free to checkout the\n[ABOUT.md](ABOUT.md) for more details on the repository itself.\n\n## What is an SBOM?\n\nA \"software bill of materials\", or SBOM, is a document that describes the\ncontents of a software application. Everything from the existing files in\nthe application to the open source components added during the application\nbuild. The content of the SBOM is meant to represent a snapshot of the\ncontents at a given time and stage in the lifecycle of software.\n\nYou can find more details on SBOM at the [CISA SBOM\nsite](https://www.cisa.gov/sbom)\n\n### SBOM formats\n\nThere are currently two popular SBOM formats in use. SPDX and CycloneDX.\n\n### Lifecycle of an SBOM\n\nWhile an SBOM is a static document, pinpointing what is in software when a\nscan was run, there are differet stages of development you can capture and\ncompare an SBOM. For example we could take a very simple view of breaking\nour development down into: source, build, and runtime. Each of these SBOMs\nwill be different and contain different content. Each stage is important\nand should be captured.\n\n#### Source\nThe source SBOM represents your application during development. This SBOM\ncould contain development dependencies, development versions of open source\npackages. It might contain files that only exist in certain branches of\nyour source management system.\n\nA source SBOM gives you the ability to understand if any of your\ndependencies are outdated (includeing development dependencies, these often\nget ignored). You can also use source SBOMs as a sort of time machine to\nlook back to when a certain file or dependency was first added to the\nproject.\n\n#### Build\nThe build SBOM is the SBOM that you generate during a build. It could be a\npartial build, or a test build, or even the final build. By generating an\nSBOM during the build stage you can look back into what exactly was built\nand shipped for any product or component.\n\nThis SBOM will differ from the source SBOM because during a build things\ncan happen that are outisde of a development environment. Maybe a container\nis created. A binary could be copied into the build. Builds can be signed\nduring this stage, the signatures and checksums can also be captured by the\nSBOM scanner.\n\n#### Runtime\n\nA runtime SBOM is the thing that will be deployed into an environment. It\nwill contain final builds, supporting libraries (like an operating system\nor container image). The configuration files have been updated, defaults\nhave probably changed. It's even possible someone modified some of the\ncontents that we were tracking in the build SBOM.\n\nThe runtime SBOM can help us understand when our application contains\nsecurity vulnerabilities. It can give us insight into what we've changed in\nour running deployment vs what we received from our vendor. It can also\ngive us insight into understnading how old our application and depdnecies\nare.\n\n## How can I make an SBOM?\n\nThe single easiest way to create an SBOM is to use a tool called\n[Syft](https://github.com/anchore/syft/)\n\nThere are a variety of ways to install Syft, please see these\n[instructions](https://github.com/anchore/syft/#installation) for the best\nway on your system.\n\nOnce Syft is installed, it's very easy to run.\n\nWe are going to base these exapmles on Syft itself. The first thing we will\ndo is pull the Syft GitHub repository\n\n`git clone https://github.com/anchore/syft.git`\n\n### Scanning a directory\n\nYou can scan a directory with Syft. We should scan the repository we just\nchecked out.\n\nFirst run\n```\n➜  ~ syft  src/syft\n```\n\nThis command will give us a lot of output. This is our source SBOM. There\nare a lot of packages that won't end up in our final build, so this is a\ngreat example.\n\nNow if we want to do something more useful, we should run\n\n```\n➜  ~ syft  -o json --file=syft-source-sbom.json src/syft\n ✔ Indexed src/syft\n ✔ Cataloged packages      [841 packages]\n```\n\nThe 841 packages will be important later, so keep it in mind. These\npackages are all the things included in Syft that we need to develop it.\nThis isn't an uncommonly large number, this is pretty normal.\n\nThe `-o json` tells syft to use the syft json format. Because we will use\nthis file later with Grype, we are going to stick with the Syft format. But\nSyft supports a variety of formats including SPDX and CycloneDX.\n\nThe `--file=syft-sbom.json` is the output file of the command.\n\nNow let's generate a build SBOM. How to build Syft is a bit more complex\nthan we want to cover here, but here's what happens when when we scan the\nbuild.\n\n```\n➜  ~ syft  -o json --file=syft-build-sbom.json src/syft\n ✔ Indexed src/syft\n ✔ Cataloged packages      [4536 packages]\n```\n\nNotice after the build. we have 4536 packages that get scanned now. These\nare all the development and build artifacts needed to create the Syft\nbinary.\n\nAnd lastly, let's scan the Syft container, which is what gets deployed.\n\n```\n➜  ~ ./syft -o json --file=syft-deploy-sbom.json docker.io/anchore/syft:latest \n ✔ Parsed image\n ✔ Cataloged packages      [227 packages]\n```\n\nThe container only has 227 packages in it, this seems far more reasonable.\nBut it's important to keep in mind that all those other packages are part\nof our supply chain. We cannot ignore those packages.\n\n## What can I do with an SBOM?\n\nDetect drift between the types above\n\nLook for a certain package as deployed\n\nLook for vulnerabilities, now and in the future\n\nUnderstand your supply chain\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fsbom-examples","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanchore%2Fsbom-examples","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fsbom-examples/lists"}