Skip to content

Commit a2080bd

Browse files
viveksahu26viveksahu26
authored
Docs/examples each cmd (#207)
* add enrich examples * add remove examples * add edit examples * add assemble examples
1 parent 39f4602 commit a2080bd

File tree

10 files changed

+70806
-0
lines changed

10 files changed

+70806
-0
lines changed

‎samples/test/assemble/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Testing Editing Feature
2+
3+
- This is for testing of assemble command. And below commands are the examples of the same.
4+
- Assembly supported 3 ways of assembling SBOMs:
5+
- Flag merge
6+
- Assembly Merge
7+
- Hierarchical Merge
8+
9+
- Flat Merge means:
10+
11+
- Does not reference input SBOM primary components.
12+
- In this, all the all the primary components as well as components of all SBOMs are placed under components section.
13+
- Primary components of input SBOMs are dependencies.
14+
15+
- Assembly Merge:
16+
- References input SBOM primary components as subcomponents of primary component of final SBOM.
17+
- Excludes primary components of input SBOMs
18+
- No dependencies listed
19+
20+
- Hierarchical Merge
21+
- Does not reference input SBOM primary components under metadata.component
22+
- Hierarchically organizes components under respective primary components
23+
- Lists primary components of input SBOMs as dependencies
24+
25+
## 1. Flag Merge
26+
27+
```bash
28+
sbomasm assemble -n "foo" -t "library" -v "v1.0.1" --flatMerge sbomex-cdx.json sbomgr-cdx.json -o flat-flag-merge-sbom.spdx.json
29+
```
30+
31+
## 2. Assemble Merge
32+
33+
```bash
34+
sbomasm assemble -n "foo" -t "library" -v "v1.0.1" --assemblyMerge sbomex-cdx.json sbomgr-cdx.json -o assemble-flag-merge-sbom.spdx.json
35+
```
36+
37+
## 3. Hierarchical Merge (Default)
38+
39+
```bash
40+
sbomasm assemble -n "foo" -t "library" -v "v1.0.1" sbomex-cdx.json sbomgr-cdx.json -o hierar-flag-merge-sbom.spdx.json
41+
```

‎samples/test/edit/README.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Testing Editing Feature
2+
3+
- This is simply to test all the features related to edit command.
4+
- It allows edit on the basis of subject. It support 3 kinds of subjects: Document, Primary COmponent, and Cmponent with name and version.
5+
6+
## Examples
7+
8+
### 1. Edit Document
9+
10+
1. Append author to the document
11+
12+
```bash
13+
sbomasm edit --subject document --author "Interlynk (hello@interlynk.io)" samples/test/edit/in-complete-sbom.spdx.json -o append-author-sbom.spdx.json --append
14+
15+
sbomasm edit --subject document --author "Interlynk (hello@interlynk.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-author-sbom.cdx.json --append
16+
```
17+
18+
- Similarly for other fields:
19+
20+
```bash
21+
# supplier(SPDX doesn't support)
22+
sbomasm edit --subject document --supplier "Interlynk (https://interlynk.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-supplier-sbom.cdx.json --append
23+
24+
# lifecycle
25+
sbomasm edit --subject document --lifecycle "source" samples/test/edit/in-complete-sbom.spdx.json -o append-lifecycle-sbom.spdx.json --append
26+
27+
sbomasm edit --subject document --lifecycle "source" samples/test/edit/in-complete-sbom.cdx.json -o append-lifecycle-sbom.cdx.json --append
28+
29+
# license
30+
sbomasm edit --subject document --license "CC0-1.1" samples/test/edit/in-complete-sbom.spdx.json -o append-license-sbom.spdx.json
31+
32+
sbomasm edit --subject document --license "Acme Customer Data License" samples/test/edit/in-complete-sbom.cdx.json -o append-license-sbom.cdx.json
33+
34+
# repository(SPDX doesn't support)
35+
sbomasm edit --subject document --repository "https://kyverno.io/" samples/test/edit/in-complete-sbom.cdx.json -o append-repo-sbom.cdx.json --append
36+
```
37+
38+
### 2. Edit Primary Component
39+
40+
```bash
41+
sbomasm edit --subject primary-component --author "Jim (jim@nirmata.com)" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-author-sbom.spdx.json --append
42+
43+
sbomasm edit --subject primary-component --author "Interlynk (hello@interlynk.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-author-sbom.cdx.json --append
44+
```
45+
46+
- Similarly for other fields:
47+
48+
```bash
49+
# supplier
50+
sbomasm edit --subject primary-component --supplier "Kyverno (https://kyverno.io)" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-supplier-sbom.spdx.json --append
51+
52+
sbomasm edit --subject primary-component --supplier "Kyverno (https://kyverno.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-pc-supplier-sbom.cdx.json --append
53+
54+
# license
55+
sbomasm edit --subject primary-component --license "Apache-2.0" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-license-sbom.spdx.json
56+
57+
sbomasm edit --subject primary-component --license "Apache-2.0" samples/test/edit/in-complete-sbom.cdx.json -o append-pc-license-sbom.cdx.json
58+
59+
# copyright
60+
sbomasm edit --subject primary-component --copyright "Copyright 2025, the Kyverno project" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-copyright-sbom.spdx.json
61+
62+
sbomasm edit --subject primary-component --copyright "Copyright 2025, the Kyverno project" samples/test/edit/in-complete-sbom.cdx.json -o append-pc-copyright-sbom.cdx.json
63+
64+
# description
65+
sbomasm edit --subject primary-component --description "Kyverno is a policy engine designed for Kubernetes." samples/test/edit/in-complete-sbom.spdx.json -o append-pc-description-sbom.spdx.json
66+
67+
sbomasm edit --subject primary-component --description "Kyverno is a policy engine designed for Kubernetes." samples/test/edit/in-complete-sbom.cdx.json -o append-pc-description-sbom.cdx.json
68+
69+
# repository
70+
sbomasm edit --subject primary-component --repository "https://github.com/kyverno/kyverno/releases" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-repository-sbom.spdx.json
71+
72+
73+
sbomasm edit --subject primary-component --repository "https://github.com/kyverno/kyverno/releases" samples/test/edit/in-complete-sbom.cdx.json -o append-pc-repository-sbom.cdx.json
74+
75+
# type
76+
sbomasm edit --subject primary-component --type "APPLICATION" samples/test/edit/in-complete-sbom.spdx.json -o append-pc-type-sbom.spdx.json
77+
78+
sbomasm edit --subject primary-component --type "APPLICATION" samples/test/edit/in-complete-sbom.cdx.json -o append-pc-type-sbom.cdx.json
79+
80+
```
81+
82+
### 3. Edit Specific Component
83+
84+
In whole examples, we will take a component `github.com/fluxcd/pkg/oci` and version `v0.45.0`
85+
86+
```bash
87+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --author "Stefan Prodan (stefan@fluxcd.io)" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-author-sbom.spdx.json --append
88+
89+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --author "Stefan Prodan (stefan@fluxcd.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-author-sbom.cdx.json --append
90+
```
91+
92+
- Similarly for other fields:
93+
94+
```bash
95+
# supplier
96+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --supplier "Flux (https://fluxcd.io)" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-supplier-sbom.spdx.json --append
97+
98+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --supplier "Flux (https://fluxcd.io)" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-supplier-sbom.cdx.json --append
99+
100+
# license
101+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --license "Apache-2.0" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-license-sbom.spdx.json
102+
103+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --license "Apache-2.0" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-license-sbom.cdx.json
104+
105+
# copyright
106+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --copyright "Copyright 2025, the FluxCD project" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-copyright-sbom.spdx.json
107+
108+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --copyright "Copyright 2025, the FluxCD project" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-copyright-sbom.cdx.json
109+
110+
# description
111+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --description "The OCI package provides utilities for working with OCI images and registries." samples/test/edit/in-complete-sbom.spdx.json -o append-comp-description-sbom.spdx.json
112+
113+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --description "The OCI package provides utilities for working with OCI images and registries." samples/test/edit/in-complete-sbom.cdx.json -o append-comp-description-sbom.cdx.json
114+
115+
# repository
116+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --repository "https://github.com/fluxcd/pkg/oci" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-repository-sbom.spdx.json
117+
118+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --repository "https://github.com/fluxcd/pkg/oci" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-repository-sbom.cdx.json
119+
120+
# type
121+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --type "library" samples/test/edit/in-complete-sbom.spdx.json -o append-comp-type-sbom.spdx.json
122+
123+
sbomasm edit --subject component-name-version --search "github.com/fluxcd/pkg/oci (v0.45.0)" --type "library" samples/test/edit/in-complete-sbom.cdx.json -o append-comp-type-sbom.cdx.json
124+
```

‎samples/test/edit/in-complete-sbom.cdx.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.4",
5+
"serialNumber": "urn:uuid:4d2edcda-fcc4-42fe-8e9d-87cf33e47b94",
6+
"version": 1,
7+
"metadata": {
8+
"timestamp": "2025-04-25T00:42:27Z",
9+
10+
"component": {
11+
"bom-ref": "pkg:golang/github.com/kyverno/kyverno@v1.14.0?type=module#cmd/kyverno",
12+
"type": "application",
13+
"name": "github.com/kyverno/kyverno",
14+
"version": "v1.14.0",
15+
"purl": "pkg:golang/github.com/kyverno/kyverno@v1.14.0",
16+
"cpe": "cpe:/golang/github.com/kyverno/kyverno:v1.14.0",
17+
"hashes": [
18+
{
19+
"alg": "SHA-256",
20+
"content": "89fb71dddbb3389dd3018c7f63dd6350b1611f382613c5c31edfee67006ac28e"
21+
}
22+
]
23+
}
24+
},
25+
"components": [
26+
{
27+
"bom-ref": "pkg:golang/github.com/fluxcd/pkg/oci@v0.45.0?type=module",
28+
"type": "library",
29+
"name": "github.com/fluxcd/pkg/oci",
30+
"version": "v0.45.0",
31+
"scope": "required",
32+
"hashes": [
33+
{
34+
"alg": "SHA-256",
35+
"content": "94fb71aaacc3385dd3018c7e63dd6750b1622f382613c5c31edfee67006ac78e"
36+
}
37+
],
38+
"purl": "pkg:golang/github.com/fluxcd/pkg/oci@v0.45.0",
39+
"cpe": "cpe:2.3:a:fluxcd:oci:v0.45.0:*:*:*:*:*:*:*"
40+
},
41+
{
42+
"bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.17.0?type=module",
43+
"type": "library",
44+
"name": "github.com/Azure/azure-sdk-for-go/sdk/azcore",
45+
"version": "v1.17.0",
46+
"scope": "required",
47+
"hashes": [
48+
{
49+
"alg": "SHA-256",
50+
"content": "834119270cfbc645d0899008e718bd7f75961580655f508f4eb47e3434e84644"
51+
}
52+
],
53+
"purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.17.0",
54+
"cpe": "cpe:/golang/github.com/azure/azure-sdk-for-go/sdk/azcore:v1.17.0"
55+
},
56+
{
57+
"bom-ref": "pkg:golang/github.com/sigstore/rekor@v1.3.9?type=module",
58+
"type": "library",
59+
"name": "github.com/sigstore/rekor",
60+
"version": "v1.3.9",
61+
"scope": "required",
62+
"hashes": [
63+
{
64+
"alg": "SHA-256",
65+
"content": "b148d1a4a561fe1860a8632cd2df93b9b818b24b00ad9ea9a0b102dccb060335"
66+
}
67+
],
68+
"purl": "pkg:golang/github.com/sigstore/rekor@v1.3.9",
69+
"cpe": "cpe:/golang/github.com/sigstore/rekor:v1.3.9"
70+
},
71+
{
72+
"bom-ref": "pkg:golang/cel.dev/expr@v0.19.1?type=module",
73+
"type": "library",
74+
"name": "cel.dev/expr",
75+
"version": "v0.19.1",
76+
"scope": "required",
77+
"hashes": [
78+
{
79+
"alg": "SHA-256",
80+
"content": "35c898aed0d1211d253429c7d4b1497a0763b29371f5f239f4eed359cb9afd6e"
81+
}
82+
],
83+
"purl": "pkg:golang/cel.dev/expr@v0.19.1",
84+
"cpe": "cpe:/golang/cel.dev/expr:v0.19.1"
85+
}
86+
],
87+
"dependencies": [
88+
{
89+
"ref": "pkg:golang/github.com/kyverno/kyverno@v1.14.0?type=module#cmd/kyverno",
90+
"dependsOn": [
91+
"pkg:golang/github.com/fluxcd/pkg/oci@v0.45.0?type=module",
92+
"pkg:golang/github.com/sigstore/rekor@v1.3.9?type=module"
93+
]
94+
},
95+
{
96+
"ref": "pkg:golang/github.com/fluxcd/pkg/oci@v0.45.0?type=module",
97+
"dependsOn": [
98+
"pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.17.0?type=module"
99+
]
100+
},
101+
{
102+
"ref": "pkg:golang/github.com/sigstore/rekor@v1.3.9?type=module",
103+
"dependsOn": [
104+
"pkg:golang/cel.dev/expr@v0.19.1?type=module"
105+
]
106+
}
107+
]
108+
}

0 commit comments

Comments
 (0)