SBOMgensbomgen

Creating SBOMS from CSVs

Introduction

This tutorial illustrates how to create SBOMs from CSV/Excel files using the CSV2CDX CLI application.

Requirements & Prerequisites

Installation

Via Pip/Pipx

Run the following command:

pip install git+https://github.com/cybeats/csv2cdx.git@main

Via Git Clone + Pip/Pipx

Run the following command:

git clone https://github.com/cybeats/csv2cdx.git
cd csv2cdx
pip install -e .

Verify installation by running:

csv2cdx -h

You should see the resultant output

usage: csv2cdx [-h] {template,build} ...

csv2cdx v2.0.3

positional arguments:
  {template,build}
    template        Generates json configuration template file. Run csv2cdx
                    template -h for more details
    build           Build sbom given args. Run csv2cdx build -h for more
                    details

options:
  -h, --help        show this help message and exit

Usage

CSV2CDX operates on building SBOMs from CSV/Excel files through the use of a configuration JSON file.

Configuration File Creation

To create a template file, run the command:

csv2cdx template -name <optional>

Where -name is an optional flag to designate the configuration file name. Without the flag, the configuration file defaults to config_template.json. You should see a JSON file with the selected name in your current directory.

Opening the configuration file, you should see the following:

{
    "bom-ref": null,
    "name": null,
    "version": null,
    "group": null,
    "publisher": null,
    "purl": null,
    "mime type": null,
    "description": null,
    "author": null,
    "cpe": null,
    "swid": null,
    "pedigree": null,
    "components": null,
    "evidence": null,
    "releaseNotes": null,
    "copyright": null,
    "supplier": null,
    "licenses": [
        {
            "license_name": null,
            "license_url": null,
            "license_id": null
        }
    ],
    "hashes": [
        {
            "hash_alg": null,
            "hash_content": null
        }
    ],
    "externalReferences": [
        {
            "er_type": null,
            "er_url": null
        }
    ]
}

Configuration File Population

Populating the configuration file can be done by adding the name of the CSV/Excel column to the corresponding parameter e.g:

"name": "Component_Name",
"version": "component_version",
"type": "comp_type",

(Note: “type” object MUST be one of the types inherent to the CycloneDX json format)

To populate array fields such as licenses, hashes and external references, the requisite json object can be duplicated for every occurence e.g:

"licenses": [
      {
        "license_name": "license_1",
        "license_url": "license_url_1",
        "license_id": "license_id_1"
      },    {
        "license_name": "license_2",
        "license_url": "license_url_2",
        "license_id": "license_id_2"
      },    {
        "license_name": "license_3",
        "license_url": "license_url_3",
        "license_id": "license_id_3"
      }
    ]

Building

Basic

With the populated configuration and CSV/Excel files, run the following:

csv2cdx build -f (csv file path) -c (configuration json file path) -pn (name of sbom)  -pv (sbom version) -t (sbom type) -pt (sbom package type)

Where:

This will create a file of the style csv-file-name_sbom.json.

Extended

Additional flags can be set for the SBOM root component:

Further functionality for the SBOM output can be implemented through the following flags:

Notes

Example SBOM

These example files illustrate a csv file, configuration file and SBOM created by CSV2CDX. False data was generated by Faker.

Pretty JSON Display

example.csv 


    

     

        config.json
    

    

        

    

    

        csv2cdx SBOM
    

    

        

    

    




References






      
      

        This site is open source. Improve this page.