Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/cyclonedx/cyclonedx-cocoapods
Creates CycloneDX Software Bill-of-Materials (SBOM) from Objective-C and Swift projects that use CocoaPods.
https://github.com/cyclonedx/cyclonedx-cocoapods
bill-of-materials bom cocoapods cyclonedx mbom objective-c obom owasp saasbom sbom sbom-generator software-bill-of-materials swift vex
Last synced: 2 days ago
JSON representation
Creates CycloneDX Software Bill-of-Materials (SBOM) from Objective-C and Swift projects that use CocoaPods.
- Host: GitHub
- URL: https://github.com/cyclonedx/cyclonedx-cocoapods
- Owner: CycloneDX
- License: apache-2.0
- Created: 2019-10-10T15:04:12.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2025-01-07T05:09:44.000Z (about 1 month ago)
- Last Synced: 2025-02-04T23:38:33.841Z (9 days ago)
- Topics: bill-of-materials, bom, cocoapods, cyclonedx, mbom, objective-c, obom, owasp, saasbom, sbom, sbom-generator, software-bill-of-materials, swift, vex
- Language: Ruby
- Homepage:
- Size: 351 KB
- Stars: 22
- Watchers: 7
- Forks: 14
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
[](https://github.com/CycloneDX/cyclonedx-cocoapods/actions/workflows/ruby.yml)
[](https://badge.fury.io/rb/cyclonedx-cocoapods)
[][License]
[](https://cyclonedx.org/)
[](https://cyclonedx.org/slack/invite)
[](https://groups.io/g/CycloneDX)
[](https://twitter.com/CycloneDX_Spec)
# CycloneDX CocoaPods (Objective-C/Swift)
The CycloneDX CocoaPods Gem creates a valid CycloneDX software bill-of-material document from all
[CocoaPods](https://cocoapods.org/) project dependencies. CycloneDX is a lightweight BOM specification
that is easily created, human readable, and simple to parse.
## Installation
### From RubyGems
```shell
% gem install cyclonedx-cocoapods
```
### From Source
First, clone/copy the source code from GitHub. Then in the source code directory run these
commands (substituting the actual version number for `x.x.x`):
```shell
gem build cyclonedx-cocoapods.gemspec
gem install cyclonedx-cocoapods-x.x.x.gem
```
Building from source requires Ruby 2.6.3 or newer.
## Compatibility
*cyclonedx-cocoapods* aims to produce SBOMs according to the latest CycloneDX specification, which currently is [1.6](https://cyclonedx.org/docs/1.6/xml/).
You can use the [CycloneDX CLI](https://github.com/CycloneDX/cyclonedx-cli#convert-command) to convert between multiple BOM formats or specification versions.
## Usage
```
Generates a BOM with the given parameters. BOM component metadata is only generated if the component's name, version, and type are provided using the --name, --version, and --type parameters.
[version ]
USAGE
cyclonedx-cocoapods [options]
OPTIONS
--[no-]verbose Show verbose debugging output
-h, --help Show help message
BOM Generation
-p, --path path Path to CocoaPods project directory (default: current directory)
-o, --output bom_file_path Path to output the bom file to (default: "bom.xml"); if a *.json file is specified the output format will be JSON
--bom-version bom_version Version of the generated BOM (default: "1")
-x, --exclude-test-targets Eliminate Podfile targets whose name contains the word "test"
--shortened-strings length Trim author, publisher, and purl to characters; this may cause data loss but can improve compatibility with other systems
Component Metadata
If a podspec file is present the name, version, and type do not need to be specified as they will be set automatically.
-n, --name name (If specified version and type are also required) Name of the component for which the BOM is generated
-v, --version version Version of the component for which the BOM is generated
-t, --type type Type of the component for which the BOM is generated (one of application|framework|library|container|operating-system|device|firmware|file)
-g, --group group Group of the component for which the BOM is generated
-s, --source source_url Optional: The version control system URL of the component for the BOM is generated
-b, --build build_url Optional: The build URL of the component for which the BOM is generated
Manufacturer Metadata
--manufacturer-name name Name of the manufacturer
--manufacturer-url url URL of the manufacturer
--manufacturer-contact-name name
Name of the manufacturer contact
--manufacturer-email email Email of the manufacturer contact
--manufacturer-phone phone Phone number of the manufacturer contact
```
**Output:** BOM file at specified location, `./bom.xml` if not specified
### Example
```shell
% cyclonedx-cocoapods --path /path/to/cocoapods/project --output /path/to/bom.xml --version 6
```
#### Specific example
This repo contains files named `example_bom.xml` and `example_bom.json` that were generated with this tool.
They represent the open source [PodsUpdater application](https://github.com/kizitonwose/PodsUpdater). The PodsUpdater
code was checked out, then these three commands were run in the checked out code directory.
```shell
% pod install
% cyclonedx-cocoapods -n "kizitonwose-PodsUpdater" -v 1.0.3 -t application -s https://github.com/kizitonwose/PodsUpdater --output example_bom.xml
% cyclonedx-cocoapods -n "kizitonwose-PodsUpdater" -v 1.0.3 -t application -s https://github.com/kizitonwose/PodsUpdater --output example_bom.json
```
The JSON file here has also been run through a JSON formatter for easier reading by humans. The original JSON
output is one long line with no extra whitespace - great for computers, but difficult for humans.
### A Note About CocoaPod Subspecs
Many CocoaPods make use of [subspec functionality](https://guides.cocoapods.org/syntax/podspec.html#subspec).
Podfiles can require whole pods, or just subspecs; pods themselves may require whole pods or subspecs of other
pods. In complex projects such as React Native apps this often results in a single pod being included as a
dependency multiple times as several of its subspecs are included individually.
*cyclonedx-cocoapods* works properly with this, and adds a dependency in the BOM output for each subspec that is
required by the Podfile and throughout the chain of dependencies. Each subspec will only appear once in the BOM
file. This gives you granular detail in the BOM of which subspecs of which pods are used. This is easiest seen
with an example.
The Podfile
```ruby
target 'SampleProject' do
pod 'SamplePod/firstsubspec'
pod 'SamplePod/secondsubspec'
end
```
If the SamplePod is at v2.1, running *cyclonedx-cocoapods* on this will output a BOM file with two `component`
dependencies:
- `pkg:cocoapods/[email protected]#firstsubspec` at `https://github.com/example/SamplePod`
- `pkg:cocoapods/[email protected]#secondsubspec` at `https://github.com/example/SamplePod`
[Dependency Track](https://dependencytrack.org) (DT) is a tool that many organizations use to help automate SBOM
related tasks. When uploading an SBOM that contains multiple subspecs from the same pod, or a single subspec
alongside the complete pod dependency, the initial upload will indicate a number of dependencies equal to the number
of `component` objects within the BOM. However, DT analysis then looks for unique repositories in use which will
merge all of the subspecs of a particular pod into a single entry. On later uploads to DT of the same or similar BOM
it will indicate just the number of unique repositories.
Uploading the above SamplePod BOM file to DT will initially see two dependencies. Later analysis by DT notices
that both dependencies resolve to the same repository, so DT will then only show a single dependency.
## Contributing
To set up for local development, make a fork of this repo, make a branch on your fork named after the issue or workflow you are improving, checkout your branch, then run `bundle install`.
### Right to Contribute
This project runs the [DCO](https://probot.github.io/apps/dco/) checker to validate that the code author has the right to submit the code they are
contributing to the project. Please verify that you do have the right to contribute, then when running `git commit` add the `-s` flag to
automatically add the proper `Signed-off-by` line to the commit message.
### Pull requests
Before submitting your pull request, please do the following:
- Run `rake spec` and make sure all the tests pass. If you are adding new commands or features, they must include tests. If you are changing functionality, update the tests or add new tests as needed.
- Add a note to the CHANGELOG describing what you changed.
- Make your pull request. If it is related to an issue, add a link to the issue in the description.
## Copyright & License
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE] file for the full license.
[License]: https://github.com/CycloneDX/cyclonedx-cocoapods/blob/master/LICENSE