bomctl is format-agnostic Software Bill of Materials (SBOM) tooling, which is intended to bridge the gap between SBOM generation and SBOM analysis tools. It focuses on supporting more complex SBOM operations by being opinionated on only supporting the NTIA minimum fields or other fields supported by protobom.
Note
This is an experimental project under active development. We'd love feedback on the concept, scope, and architecture!
- Work with multiple SBOMs in tree structures (through external references)
- Fetch and push SBOMs using HTTPS, OCI, and GIT protocols
- Leverage a
.netrcfile to handle authentication - Manipulate SBOMs with commands like
diff,split, andredact - Manage SBOMs using a persistent database cache
- Interface with OpenSSF projects and services like GUAC and Sigstore
- #bomctl on OpenSSF Slack
- OpenSSF Security Tooling Working Group Meeting - Every two weeks on Friday, 8am Pacific
- SBOM Tooling Working Meeting - Every Monday, 2pm Pacific
brew tap bomctl/bomctl && brew install bomctlContainer images for bomctl can be found on Docker Hub.
docker run bomctl/bomctl:latest --helpInstalling bomctl requires the following:
Clone the bomctl repository
git clone https://github.com/bomctl/bomctl.git
cd bomctlBuild using the Makefile
| Operating System | Architecture | make Command |
|---|---|---|
| Linux | AMD64 | make build-linux-amd |
| Linux | ARM | make build-linux-arm |
| Windows | AMD64 | make build-windows-amd |
| Windows | ARM | make build-windows-arm |
| MacOS | AMD64 | make build-macos-intel |
| MacOS | ARM | make build-macos-apple |
Ability to retrieve an SBOM via several protocols:
- HTTP/S
- Git
and from various locations:
- Local Filesystem
- OCI
This includes recursive loading of external references in an SBOM to other SBOMs and placing them into the persistent cache. If SBOMs are access controlled, a user's .netrc file to authenticate.
TBD
TBD
TBD
TBD
TBD
TBD
TBD
TBD
Container images for bomctl can be found here and are signed
using keyless signing with cosign.
You can then verify this container image with cosign.
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/bomctl/bomctl/\.github/.+' bomctl/bomctl:latestbomctl releases can be found here and are signed
using keyless signing with cosign.
You can then verify this artifact with cosign.
cosign verify-blob --certificate ${artifact}-keyless.pem --signature ${artifact}-keyless.sig --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github\.com/bomctl/bomctl/\.github/.+' ${artifact}If the result is Verified OK, the verification is successful.
You can also look up the entry in the public Rekor instance using a sha256 hash.
shasum -a 256 bomctl_SNAPSHOT-3f16bdb_checksums.txt |awk '{print $1}'The printed hash can be used to look up the entry at https://search.sigstore.dev/.
Copyright © bomctl a Series of LF Projects, LLC For web site terms of use, trademark policy and other project policies please see https://lfprojects.org.