Skip to content

Commit 96c339d

Browse files
committed
Readme updates
1 parent 8d0997c commit 96c339d

File tree

1 file changed

+22
-8
lines changed

1 file changed

+22
-8
lines changed

README.md

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,20 @@ docker run -v .:/app/sboms/ ghcr.io/interlynk-io/sbomasm:v0.1.3 assemble -n "ass
6464
sbomasm assemble -n "mega cdx app" -v "1.0.0" -t "application" -e 1.4 -o final-product.cdx.json sbom1.json sbom2.json sbom3.json
6565
```
6666

67+
#### Dependency Track Integration
68+
69+
Assemble 2 projects from DT into a flat merged assembled sbom, and save the file to local disk.
70+
```sh
71+
sbomasm assemble dt -d -u "http://localhost:8081/" -k "odt_EpqhWc1Meuc50VeD0w5fuyKELt5dbCUb" -n "mega-app" -v "1.0.0
72+
" -t "application" -f -o merged_sbom.json 08c2777b-bc4f-4b98-be54-e3f901736d71 9d94d566-a20c-4b65-b1b8-18dc4e238a55
73+
```
74+
75+
Assemble 2 projects from DT using flat merge and push the assembled sbom to another project
76+
```sh
77+
./build/sbomasm assemble dt -d -u "http://localhost:8081/" -k "odt_EpqhWc1Meuc50VeD0w5fuyKELt5dbCUb" -n "mega-app" -v "1.0.0
78+
" -t "application" -f -o 1379d800-abb0-498b-a6e5-533318670e40 08c2777b-bc4f-4b98-be54-e3f901736d71 9d94d566-a20c-4b65-b1b8-18dc4e238a55
79+
```
80+
6781
### Edit SBOMs
6882
Change the name and version of the primary component.
6983
```sh
@@ -160,14 +174,14 @@ for input and output formats
160174
## Merge Algorithm
161175
The default merge algorithm is `Hierarchical` merge.
162176
163-
| Algo | SBOM Spec | Notes |
164-
|----------|----------|----------|
165-
| Hierarchical | CycloneDX | For each input SBOM, we associate the dependent components with its primary component. This primary component is then included as a dependent of the newly created primary component for the assembled SBOM. |
166-
| Flat | CycloneDX | Provides a flat list of components, duplicates are not removed. |
167-
| Assembly | CycloneDX | Similar to Hierarchical merge, but treats each sbom as not dependent, so no relationships are created with primary. |
168-
| Hierarchical | SPDX | It maintains relationships among all the merged documents. Contains relationship is using to express dependencies. No duplicate components are removed.|
169-
| Flat | SPDX | It creates a flat list of all packages and files. It removes all relationships except the describes relationship|
170-
| Assembly | SPDX | Similar to Hierarchical, except the contains relationship is omitted |
177+
| Algo | SBOM Spec| Duplicates | Notes |
178+
|----------|----------|------|----------|
179+
| Hierarchical | CycloneDX | Not Removed | For each input SBOM, we associate the dependent components with its primary component. This primary component is then included as a dependent of the newly created primary component for the assembled SBOM|
180+
| Flat | CycloneDX | Removed | Provides a flat list of components |
181+
| Assembly | CycloneDX | Removed | Similar to Hierarchical merge, but treats each sbom as not dependent, so no relationships are created with primary. |
182+
| Hierarchical | SPDX | Not Removed | It maintains relationships among all the merged documents. Contains relationship is using to express dependencies. No duplicate components are removed.|
183+
| Flat | SPDX | Not Removed | It creates a flat list of all packages and files. It removes all relationships except the describes relationship|
184+
| Assembly | SPDX | Not Removed | Similar to Hierarchical, except the contains relationship is omitted |
171185
172186
# A complete example/use-case
173187
Interlynk produces a variety of closed-source tools that it offers to its customers. One of its security-conscious customers recognizes the importance of being diligent about the tools running on its network and has asked Interlynk to provide SBOMs for each tool. Interlynk has complied with this request by providing individual SBOMs for each tool it ships to the customer. However, the customer soon realizes that keeping track of so many SBOMs, which they receive at regular intervals, is challenging. To address this issue, the customer automates the process by combining all the SBOMs provided by Interlynk into a single SBOM, which they can monitor more easily using their preferred tool.

0 commit comments

Comments
 (0)