SBOM - Software Bill of Materials

vcn can identify, authenticate and notarize dependencies of the software assets.

Supported languages/environments

The column "Component scheme" is related to this section.

Working with builds

Resolving dependencies

vcn bom <asset> [bom options] [bom output options]

This command resolves the dependencies for the asset and prints out the list of dependencies.

Following bom options modify the behavior of this command:

See output options for details about outputting BoM in standard formats.

Examples:

vcn bom immudb/immuclient vcn bom immudb-py --bom-spdx immudb-py.spdx vcn bom immudb-py/requirements.txt --bom-file .bom

Authentication

vcn a --bom <asset> [bom options] [bom output options]

This command resolves the dependencies for the asset, authenticates the dependencies, the asset, and prints out the list of dependencies with their trust levels.

If <asset> is specified as hash using --hash option, BOM gets loaded from the server.

Following bom options modify the behavior of this command:

Any of these options (except --signerID and --github-token) implies --bom mode.

See output options for details about outputting BoM in standard formats.

This command returns one of the following exit codes:

• 0 - success; all assets' statuses are trusted
• 1 - any dependency or BoM source is untrusted
• 2 - any dependency or BoM source is unknown and there are no untrusted or unsupported dependencies
• 3 - any dependency or BoM source is unsupported and there are no untrusted dependencies

Examples:

vcn a immudb/immuclient --signerID auditor --bom-deps-only vcn a immudb/cmd/immudb/ --bom-trust-level unknown --bom-spdx immudb.spdx --bom-file .bom vcn a immudb-py --bom-max-unsupported 12.5

Notarization

vcn n --bom <asset> [bom options] [bom output options]

This command resolves the dependencies for the asset, authenticates and notarizes the dependencies (only the unknown one, if --bom-force is not specified) and the asset, and prints out the list of dependencies with their trust levels.

Following options modify the behavior of this command:

Any of these options (except --github-token) implies --bom mode.

Examples:

vcn n immudb/immuclient --bom-signerID auditor --bom-deps-only vcn n immudb/immudb/cmd/immudb/ --bom-file .bom --attr version=v1.2.3 vcn n immudb-py --bom-force --bom-spdx immudb.spdx --attach immudb.spdx

Output options

User can specify one or several options to output BoM in different supported standard formats.

Any of this options implies --bom mode.

Working with individual dependencies

vcn a|n|ut|us <scheme>://<name>@<version> | --hash <hash>

Individual components are authenticated/notarized/unsupported/untrusted as any other asset, but you need to specify either component hash with --hash option or component path in the form <scheme>://<name>@<version>. Scheme specifies the type of software component and should be the one from the supported types.

Examples:

vcn a gocom://golang.org/x/text@v0.3.6 vcn n --hash 691631371bfa886425c956999a4e998181036be260d7c0f179b3d2adde9b8353 vcn ut pythoncom://six@1.14.0

Looking up artifacts by dependency

vcn a --bom-what-includes (<scheme>://<name>@<version> | --hash <hash>)

This command lists all assets where specified component is used as a dependency. Component must be specified by hash with --hash option, or component path in the form <scheme>://<name>@<version>. Scheme specifies the type of software component, and should be the one from the supported types (except docker scheme).

Examples:

vcn a --bom-what-includes gocom://golang.org/x/text@v0.3.6 vcn a --bom-what-includes --hash 691631371bfa886425c956999a4e998181036be260d7c0f179b3d2adde9b8353

Support for containers

vcn <command> <scheme>://<image_or_container> [command options]

Supported schemes:

• docker - Docker image ID or tag, requires running docker deamon
• container - Docker container ID or tag, requires running docker deamon
• image - container image in container registry/docker image/saved image in tarball.
  • by default read image from remote registry, URL format: image://[<registry_server>/]image_tag. If <registry_server> is not specified, Docker Hub is used. By default vcn tries to connect to the registry using active Docker session, however user can always override it by using image-registry-user and image-registry-password/image-registry-password-file CLI parameters.
  • if CLI parameter --image-docker-daemon is specified, image is taken from Docker daemon, so it is same as using docker URL scheme
  • if CLI parameter --image-tar is specified, the image is read from tarball

For the image:// schema you can specify several additional options:

• --image-platform - in case when remote registry is used, you can optionally specify the platform, eg. --image-platform linux/amd64. By default your local platform is used.
• If you intend to scan images from a remote registry (Docker Hub) you need to provide --image-registry-user and --image-registry-password. Other options are explained in help files.

If asset is specified as TAR file which contains exported image, vcn processes it as image.

Examples:

vcn a --bom docker://alpine:latest --bom-spdx docker.spdx vcn a --bom container://magical_hoover vcn n --bom image://codenotary/immudb:1.3 --image-docker-daemon vcn n --bom image://my_registry.com/my_image --image-registry-user my_user --image-registry-password my_API_key vcn n --bom image://debian_11.tar --image-tar

Cascade operations

vcn notarize|untrust|unsupport [command options ...] --bom-cascade [--bom-force]

It is possible to automatically propagate the action on the asset to other assets that include the one being processed, by specifying --bom-cascade option.

When this option is specified, vcn shows the list of assets that include current one, which has a status, different from desired one, and requests the confirmation (unless --bom-force is specified) from the user.

Examples:

vcn n --hash 0fcc60c04098ec262fc7e6369f8b01cfddc99fd251bf1762cb2a3c0937ee29a6 --bom-cascade vcn untrust gocom://gopkg.in/yaml.v2@v2.4.0 --bom-cascade --bom-force