File size: 901 Bytes
7c19d46 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | #!/usr/bin/env bash
# =============================================================================
# SBOM Generation — CycloneDX + SPDX
# =============================================================================
set -euo pipefail
IMAGE="${1:?Usage: $0 <image>}"
REPORT_DIR="${REPORT_DIR:-./scan-reports}"
mkdir -p "${REPORT_DIR}"
echo "=== Generating SBOM for ${IMAGE} ==="
# SPDX format (via Trivy)
trivy image \
--format spdx-json \
--output "${REPORT_DIR}/sbom.spdx.json" \
"${IMAGE}"
# CycloneDX format (via Syft)
syft "${IMAGE}" \
-o cyclonedx-json > "${REPORT_DIR}/sbom.cyclonedx.json"
# Vulnerability report attached to SBOM
grype "${IMAGE}" \
-o json > "${REPORT_DIR}/grype-vulns.json"
echo "=== SBOM generated ==="
echo " SPDX: ${REPORT_DIR}/sbom.spdx.json"
echo " CycloneDX: ${REPORT_DIR}/sbom.cyclonedx.json"
echo " Vulns: ${REPORT_DIR}/grype-vulns.json"
|