def create_bom(project_type, bom_file, src_dir="."):
"""Method to create BOM file by executing cdxgen command
:param project_type: Project type
:param bom_file: BOM file
:param src_dir: Source directory
:returns True if the command was executed. False if the executable was not found.
"""
cdxgen_cmd = os.environ.get("CDXGEN_CMD", "cdxgen")
if not shutil.which(cdxgen_cmd):
LOG.warning(
"{} command not found. Please install using npm install @appthreat/cdxgen or set PATH variable"
.format(cdxgen_cmd))
return False
args = [cdxgen_cmd, "-r", "-t", project_type, "-o", bom_file, src_dir]
exec_tool(args)
return os.path.exists(bom_file)
def create_bom(project_type, bom_file, src_dir="."):
"""Method to create BOM file by executing cdxgen command
:param project_type: Project type
:param bom_file: BOM file
:param src_dir: Source directory
:returns True if the command was executed. False if the executable was not found.
"""
cdxgen_cmd = os.environ.get("CDXGEN_CMD", "cdxgen")
if not shutil.which(cdxgen_cmd):
LOG.warning(
"{} command not found. Please install using npm install @appthreat/cdxgen or set PATH variable"
.format(cdxgen_cmd))
return False
if project_type in ("docker"):
LOG.info(
f"Generating Software Bill-of-Materials for container image {src_dir}. This might take a few mins ..."
)
args = [cdxgen_cmd, "-r", "-t", project_type, "-o", bom_file, src_dir]
exec_tool(args)
return os.path.exists(bom_file)
def get_pkg_list(xmlfile):
"""Method to parse the bom xml file and convert into packages list
:param xmlfile: BOM xml file to parse
:return list of package dict
"""
if xmlfile.endswith(".json"):
return get_pkg_list_json(xmlfile)
pkgs = []
try:
et = parse(xmlfile)
root = et.getroot()
for child in root:
if child.tag.endswith("components"):
for ele in child.iter():
if ele.tag.endswith("component"):
licenses = get_licenses(ele)
pkgs.append(get_package(ele, licenses))
except xml.etree.ElementTree.ParseError as pe:
LOG.debug("Unable to parse {} {}".format(xmlfile, pe))
LOG.warning(
"Unable to produce Software Bill-of-Materials for this project. Execute the scan after installing the dependencies!"
)
return pkgs
