Creating SBOMs from Manifests -- syft, grype

Tooling Package Management
1

Has anyone used something like

or GitHub - anchore/grype: A vulnerability scanner for container images and filesystems

with Julia Packages?

I need to create SBOMs to get Julia and its packages approved. I think these are the tools they recommend using. I think ultimately I need a CycloneDX SBOM file.

Any work being done on this? Anyone else have this problem?

1 Like
2

I believe Trivy can generate SBOMs from Pkg project and manifest files. Julia - Trivy

1 Like
3

I have never needed or used it, but [ANN] PkgToSoftwareBOM v0.1.12: Options to include the package server and artifact build scripts in the SBOM should be of some relevance.

1 Like