https://github.com/ozonru/cyclonedx-go
Creates CycloneDX Software Bill-of-Materials (SBOM) from Go projects. So you can use it with DependencyTrack to monitor security issues in 3rd party modules.
https://github.com/ozonru/cyclonedx-go
bill-of-materials bom component-analysis cyclonedx sbom security security-tools software-composition-analysis
Last synced: about 1 month ago
JSON representation
Creates CycloneDX Software Bill-of-Materials (SBOM) from Go projects. So you can use it with DependencyTrack to monitor security issues in 3rd party modules.
- Host: GitHub
- URL: https://github.com/ozonru/cyclonedx-go
- Owner: ozonru
- License: gpl-3.0
- Created: 2020-01-30T07:29:09.000Z (about 6 years ago)
- Default Branch: master
- Last Pushed: 2020-02-26T09:50:42.000Z (about 6 years ago)
- Last Synced: 2024-06-20T05:06:43.970Z (over 1 year ago)
- Topics: bill-of-materials, bom, component-analysis, cyclonedx, sbom, security, security-tools, software-composition-analysis
- Language: Go
- Homepage:
- Size: 31.3 KB
- Stars: 21
- Watchers: 9
- Forks: 3
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# cyclonedx-go
The CycloneDX module for Go creates a valid CycloneDX bill-of-material document containing an aggregate of all project dependencies. [CycloneDX](https://cyclonedx.org) is a lightweight BOM specification that is easily created, human readable, and simple to parse.
## Requirements
* Go >= 1.11
* :warning: It works for projects with [Modules](https://blog.golang.org/using-go-modules) feauture enabled
## Install
### Local Installation
```bash
go get github.com/ozonru/cyclonedx-go/cmd/cyclonedx-go
```
## Usage
Navigate to the project directory and run `cyclonedx-go`. Inside it will read output from `go list -json -m all` command and print result BOM. You can specify destation for result file with option `-o`.
### Sample output
```bash
$ cyclonedx-go
```
```xml
github.com/google/uuid
1.1.1
pkg:golang/github.com/google/uuid@1.1.1
github.com/package-url/packageurl-go
0.1.0
pkg:golang/github.com/package-url/packageurl-go@0.1.0
```
## License
Permission to modify and redistribute is granted under the terms of the GPL-3 license.