Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/cyclonedx/cyclonedx-go
Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)
https://github.com/cyclonedx/cyclonedx-go
bill-of-materials bom golang library mbom obom owasp saasbom sbom software-bill-of-materials vex
Last synced: 4 days ago
JSON representation
Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)
- Host: GitHub
- URL: https://github.com/cyclonedx/cyclonedx-go
- Owner: CycloneDX
- License: apache-2.0
- Created: 2021-03-02T11:20:02.000Z (over 3 years ago)
- Default Branch: master
- Last Pushed: 2024-05-21T14:23:45.000Z (6 months ago)
- Last Synced: 2024-05-21T15:42:36.414Z (6 months ago)
- Topics: bill-of-materials, bom, golang, library, mbom, obom, owasp, saasbom, sbom, software-bill-of-materials, vex
- Language: Go
- Homepage: https://cyclonedx.org/
- Size: 656 KB
- Stars: 64
- Watchers: 8
- Forks: 27
- Open Issues: 20
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
Awesome Lists containing this project
README
# cyclonedx-go
[](https://github.com/CycloneDX/cyclonedx-go/actions/workflows/ci.yml)
[](https://goreportcard.com/report/github.com/CycloneDX/cyclonedx-go)
[](https://pkg.go.dev/github.com/CycloneDX/cyclonedx-go)
[](LICENSE)
[](https://cyclonedx.org/)
[](https://cyclonedx.org/slack/invite)
[](https://groups.io/g/CycloneDX)
[](https://twitter.com/CycloneDX_Spec)
*cyclonedx-go is a Go library to consume and produce CycloneDX Software Bill of Materials (SBOM)*
> If you just want to create BOMs for your Go projects, see [*cyclonedx-gomod*](https://github.com/CycloneDX/cyclonedx-gomod)
## Installation
```
go get github.com/CycloneDX/cyclonedx-go
```
## Usage
Please refer to the module's [documentation](https://pkg.go.dev/github.com/CycloneDX/cyclonedx-go#section-documentation).
Also, checkout the [`examples`](./example_test.go) to get an idea of how this library may be used.
## Compatibility
| cyclonedx-go versions | Supported Go versions | Supported CycloneDX spec |
|:---------------------:|:---------------------:|:------------------------:|
| < v0.4.0 | 1.14+ | 1.2 |
| == v0.4.0 | 1.14+ | 1.3 |
| >= v0.5.0, < v0.7.0 | 1.15+ | 1.4 |
| >= v0.7.0, < v0.8.0 | 1.17+ | 1.0-1.4 |
| == v0.8.0 | 1.18+ | 1.0-1.5 |
| >= v0.9.0 | 1.20+ | 1.0-1.6 |
We're aiming to support all [officially supported](https://golang.org/doc/devel/release.html#policy) Go versions, plus
an additional older version.
Prior to v0.7.0, this library only supported the latest version of the CycloneDX specification. While it is generally
possible to *read* BOMs of an older spec, *writing* would exclusively produce BOMs conforming to the latest supported spec.
Starting with v0.7.0, writing BOMs conforming to all previous version of the spec is also possible.
## Copyright & License
CycloneDX Go is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license.
See the [LICENSE](./LICENSE) file for the full license.
## Contributing
[](https://gitpod.io/#https://github.com/CycloneDX/cyclonedx-go)
Pull requests are welcome. But please read the
[CycloneDX contributing guidelines](https://github.com/CycloneDX/.github/blob/master/CONTRIBUTING.md) first.
It is generally expected that pull requests will include relevant tests. Tests are automatically run against all
supported Go versions (see [Compatibility](#compatibility)) for every pull request.