From cc3cf35f490cb8053c4fdeafe0763efade69a797 Mon Sep 17 00:00:00 2001 From: italvi <58322186+italvi@users.noreply.github.com> Date: Thu, 16 May 2024 08:00:09 +0200 Subject: [PATCH 1/5] feat: add cyclonedx editor validator tool from festo Signed-off-by: italvi <58322186+italvi@users.noreply.github.com> --- SBOM-Catalog/public/data.yaml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/SBOM-Catalog/public/data.yaml b/SBOM-Catalog/public/data.yaml index 382c6e1..cfdcfd0 100644 --- a/SBOM-Catalog/public/data.yaml +++ b/SBOM-Catalog/public/data.yaml @@ -564,4 +564,17 @@ Type: - Source Language: - - Cargo \ No newline at end of file + - Cargo + +- Name: CycloneDX Editor Validator Tool + Link: https://github.com/Festo-se/cyclonedx-editor-validator + Publisher: Festo + License: OpenSource + Standards: + - CycloneDx + Abilities: + - Edit + - Merge + - Validate + Type: + Language: From 06e3825ae482f007e97d465f1c2c88bd0f86553a Mon Sep 17 00:00:00 2001 From: italvi <58322186+italvi@users.noreply.github.com> Date: Thu, 16 May 2024 08:03:32 +0200 Subject: [PATCH 2/5] fix: add hyphen to cyclonedx editor validator tool Signed-off-by: italvi <58322186+italvi@users.noreply.github.com> --- SBOM-Catalog/public/data.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SBOM-Catalog/public/data.yaml b/SBOM-Catalog/public/data.yaml index cfdcfd0..9acf55a 100644 --- a/SBOM-Catalog/public/data.yaml +++ b/SBOM-Catalog/public/data.yaml @@ -566,7 +566,7 @@ Language: - Cargo -- Name: CycloneDX Editor Validator Tool +- Name: CycloneDX-Editor-Validator-Tool Link: https://github.com/Festo-se/cyclonedx-editor-validator Publisher: Festo License: OpenSource From 73b449bafdb252488879c01406fb3e3102694a57 Mon Sep 17 00:00:00 2001 From: italvi <58322186+italvi@users.noreply.github.com> Date: Thu, 16 May 2024 08:15:56 +0200 Subject: [PATCH 3/5] feat: create description for CycloneDX-Editor-Validator-Tool Signed-off-by: italvi <58322186+italvi@users.noreply.github.com> --- .../descriptions/CycloneDX-Editor-Validator-Tool.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md diff --git a/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md b/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md new file mode 100644 index 0000000..079188c --- /dev/null +++ b/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md @@ -0,0 +1,10 @@ +The [CycloneDX Editor Validator Tool](https://github.com/Festo-se/cyclonedx-editor-validator) is designed as a command-line tool to perform various actions on CycloneDX SBOMs. It allows you to modify, merge and validate your SBOMs. +The documentation is provided as [GitHub pages](https://festo-se.github.io/cyclonedx-editor-validator/). Tne tool can be installed via [pypi](https://pypi.org/project/cyclonedx-editor-validator/). + +## Key Features and Capabilities: +- Amend: Adds missing auto-generatable information to an existing SBOM. +- Merge: Merges two or more SBOMs into one. +- Validate: Validates an SBOM against a given specification. The tool is deployed with the default CycloneDX schema and a custom schema, but a path to schema can also be provided. +- Set: Using the command-line or a json, you can set properties on specified components in an SBOM, e.g. when information in an automtically created SBOM is missing or not correct. +- Build-public: Remove components and information with namespace internal and resolves the dependencies. +- CI-/CD-Integration: As this is a command-line tool, it can be integrated into your pipelines and the validation even provide a report, which can be used by the `warnings-ng-plugin` from Jenkins or a `code-quality-report` as required by GitLab. From 4f52db064e5333a4c05793a79dcd6d3b1ca83cce Mon Sep 17 00:00:00 2001 From: italvi <58322186+italvi@users.noreply.github.com> Date: Thu, 16 May 2024 08:18:15 +0200 Subject: [PATCH 4/5] feat: add logo for cyclonedx editor validator tool Signed-off-by: italvi <58322186+italvi@users.noreply.github.com> --- .../logos/CycloneDX-Editor-Validator-Tool.png | Bin 0 -> 5940 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 SBOM-Catalog/public/logos/CycloneDX-Editor-Validator-Tool.png diff --git a/SBOM-Catalog/public/logos/CycloneDX-Editor-Validator-Tool.png b/SBOM-Catalog/public/logos/CycloneDX-Editor-Validator-Tool.png new file mode 100644 index 0000000000000000000000000000000000000000..257e3f5083b93f0497d93c2c5e3085998a669906 GIT binary patch literal 5940 zcmbW4XEfYjx5s~s77?OFCrb24459}SqlYn!7($dNqeM-VC<)?kGRWvAdN*2#o+y!M zLxf@UAbN@3qs;Z(d)Kq>%X{y4t$ogmb6%X!IeUH2-lQ?oBoG16P*G7+QPNOTQ(w74 zLrceUjqd7IIu0gg1{NMpK3*P9Ztj~xQX)46Bn7#-MdigL?@G(c%JPXQsw#k0q-12l zWLK_Sp}R`Qe(f4Nn4g;;{C^gy4Pc}Jx`A#GnE*h}NCsjgBYh{!1pqQivi}tD-y$Oi zQBYD*(_EpwdL1Aq1A)jXK$Mge6qh@LFV_GHMoK1rX$>l7s4caC7Yq0`CWl7wLDg4Q zlfi8v89VPcS7>jrv2$?V5*85^6PJ~{C$FHWr1?+_qOGH=2QxK;n?JTd*gHIPbaHk< z`uO_2c<(|h=TfG zJY?iAF9XC#LCG&o#iRkHw)J8b0KcYTd4S2O`g%oB#$=n-&U=vdhLG&?+00O&wumk$PF1k`{*haTZv=^gWFX*7(^nmFw#;+s%jV?kbdYe1@Rk$Q$dfspJ^ehmPe(Gh| z@jPieyq|;AsJCVFuXHPSp6#&#JO)Gvud2o_~6y2J?5jh{Sx8#HU5D3 zawIFo3MEd#Q=d6;Q`}PS%_c-x8^)a;J}~s^Lm+zM(X4#3nGwXNCd4t}k4$I?!x;^t ze_2~HD6`ED#L6572Bv~35$rD%7JPqDsra&2-WZuWI;pIB*g4ZNlIz?xQYjk>gMwiV z-qr6QL3F0>H?&oVBZxN|A8%}In5HqI^i9b4SUI(iQU-|ml!;!34wE;9W*Jc<@?*;x zHP2+@w(edCxbQ&kYFRKwM(V0kA=x~&yTNK-{8{VD)7J)L(hRbG?M=Qxrnfc4wpZwK zeY)N#89;%i4e#+b6SB92^uprvi*D1<<{qdF8+>k}{bFmjVc<~Er{=I>my!~zQ=ptW zUteG-@EegKlN6+>*sVn6gw?BAJ4(b^9_Wp8;S1>amI%a zU@h%F_Q!s^$vHY)t5e~gEY!V~?pwO-l8?bgAUq!RwVle$d-L0#ZxZ2il-w%sFr&}= ze9ViOf{*Oh$3J0Ag#c`h)_B?w`=G*usUrp4&=Y;$8(=~93&!x1gHm($S$h@Ym0jI3 z;hztZG8c8Ny1&Q2vRkXo z;Yon_PQ7X~^a&x`Q@ppAJ%e9y`kNr(EtvYNythI4k9+r*o(pzj*|6gV&TKjxfHvBoG+`H zb^E*X2QgbvFg(1=Y+CJ6jTp=7p(wtUztC;2>~dlmF{X4*>z}JIwXI8!K?R{>DK-1m z3Va`EXIWgY7GCVsfNFoK^_xtp7nM(l)jXS%|4RH z(BCBsg75Q0OD2 zL)<1h(5&;_b8&CACYRJHPb!9-yn&Z3OKt-m>^@kCddq>|?DTyP7fzKIxMh*?!c8ae zryx^a_;|pItL{8*_o2VUFdUN>iBQ#ZOSP@>F*G}g-XN5NXB)TLQMPeU+g1&SU$BU3 zDZj@UgFTRS>#w2USSST{Igee#b3B}U#;=bLy zU}<$VIynlzI2+104l)g*F3?t%JM_B$)&WN-cB_O=SM;=X1y;bYJB<4T(FUE-C4Md0 z0z@(e#&aDrf;B1Y@3?1#tk?$Et&jlLKd$NpvR&8$31(5Neq~Ga>|ahhfQ{SBe1cNM z%h;&gu2L|)}li{j`mpOjd1*{`2~-b&Ki?OboPAX2hJtw%w~p>G@+-lNd*g$ zNndB>`_wSSRz+BWe#;8+%8CfzPcmQXpxu(HK|>Z`FeQ>bdZhuki-`BWLOt@Xs8OlQ z-Jp?;+b(ZxQg^b$xkfAG`0K$2)ad%-9rQBV?1cGc*@rQFj6S_O5Gtc9aCb#Q8_(DY zvdd1g(8hlW#NG)YkI5-XzPh=nWQc+Hd0BzjU(rT&S9a@WW z_I>@+j|2GBS${n2fup<(B&?tObi)h43RShQp_wN%c5?H&2I8EM*NS7i2?3&K2S; zZIx*CVeF7d?>y?6at#58b5}ioqSugQU?35$*?`#-ou9@X4JUCSZn4F2$Ki22eP5*R z*A}+%Ccz)4p3fxy9prFvR2=fq(_Jxkcs?fwceuJoHdI_Lj9$h@&f&~BWs-TpV4;7W z&ZD9(jTl*z$?X)5io@GzK3de$lHlE|N4e;w-ob;ty?PGv+ylCD&Br15s=5SsHt~+& z8n==|6ZdSIdnW8_ofC#NWRHdU)-}irosSqZhuz3CI_yf~RB`v-RwNZx8|O=zgliio zn&@o@YdNQ`-3X(Sq82GfVCX49^fQeooVHfmz2RF3Wf?`zvM7y92SA>sH!l;)_2yt4KgA-+2;zR7JdnbG!UE zo8$aXtW-%omwr$df|X7Mixzot7P0dIwJuH z5-_t!0yuZKuKMfv$6t*$T&>?t73H=5vkcsxjWq8JCWS}zg2K9xFI|1N47?=QcTa-dK2?(rK(fl3vN0dL!<7^Rwf7(^g z9c-vz`*ANt$f+_%PP(C3b3!jOvnb?n%)Q&^50VXfq%$%7w!|N->!G5QX`j5i;9wH0 z)>B?$M{ykzQrly4zu$u)X9i+Tz?QJOrZH)*noW>j@#Q|^tu5REXT4tt^&P(U#uGBK zFDne&lj*Zf5y17by68ndnpNCXYc?C#tbmtX?+Xy*w`{F79}8X1a8*%6pNrRH%)H&= zU@WspIn|Q2tGp6P8P1FM1=5eLLPvcsYQG)(d{fG7d@frjFGedE>DI`ha9F9eQ+7OqZj$W84T(fdC)85PLX=SqsSe_Ea* zD6(B%d2Bv?^D-gPp+^U}@~9{k_d<#CM5eY1@2?_pS!aRe=izgFM-`#l0(W*QACy}t z*3)9D76$X!zlsqu&MJJZ*|wVxQ|NQ(i@ZN|d85K45?=2)RgN?^-sf6_T2*~&4a-&& zWHPHdhG#|>`nOmvM_B|!CVp&Ebb&Ssg2G&B?@%9C>NdX|npb{nYRJ<4IcfmATqFkZ z4k13799S!*!KbrTCForg*OLGm>VMQ$1o_U-k)4FCT2QzU^gcym2wizyjDok@_DkA; zr%;GQpU3jYq{v*97@cS?3J}dreoswEV97;M$)XHktA(%WWFug=8s6|7BnX6l87ns2 zcREMt^OFEanYg|k(*%(;sr>ISox*?=I)(bH7iZyr9kKR}wtd}Mo5Gu+Q(&ez&`=&{- z<&s)jk&0f2E_bC7vY{86gj;ghmFh6J%A@~c_FUo|+oEk#pp8;YZDgDp)JE#Ht(jGzBmFRxet$UNHjQwc|&t+%A#x_z%puj#e7vvADIulQR-x>67l4$bL zO6eqkU6R$)l9vP!%JqvazIrYERC;*Kw|?I^_^uIEV!R3WGcm}D(Z;3Ktljo-Bms3n z)EBBK4XFbD_K9z_mp-lglCPU#-Mlz=J(o`+sJi&gM%2%MxWCKS`F_gI{5iHvnixoDfo%t*Jxroi z4n$kii;a#iVZwK~plclp?iNV1>X{nUdd2688A!sOwW;a7WAz#WhAo{z<+&&s3+z>0 z{fYQ6TGt3cDV8w*?jpF&KPgH=-}lX!Zg9y&auN_b z?AW=kr(9FB=T1FcB}p~oe_4AT8S#Dy`c>UhKYaUa{iUQ#Z8&*Z%r6V0o2Q)W<`g;b@Qeo4$Sywn@(vDPW~{PH8)3ng%(0_8R0$1MKgwA6f2D zrE(@VuY+m)bfi2-J%3rspY6vvL?2h;XADaZN;xCfTn^nmSGM-V1w_mppW^b?bh58P z-lO{JhnM7|T>>233z9hIzQ57(Z0PP@foSjlKstu8U*=#*oGhV+rUIS{FJmoaEfn~4 z`);{~1Qa|(PQ}WB_z2H?mP1pv{5RAzztcAO`JM*>8>K)G-%Mrah@@MaqD$fITFaHh#$n-$=ZQ^Bw(e^hFQH+xB zj=*c1tr+CYJ-yCHZRYrj|7bZ6+&?;_P35RV4VIp>VX4f*plLLsT_xqpMsq)CCZ|S9FM^t|6Ug-ijshFhW%`adrOA= zBw=^=kCi?X_+bfO^1IJmv0(2<)S=4=#lpCzRwxOmCJeE!A@mRw{2YZzMFdWYhwxlc kdFH9%rCc?Cb%7 literal 0 HcmV?d00001 From 76f928d1bba032cee1c44621bb5ad33a317864a2 Mon Sep 17 00:00:00 2001 From: italvi <58322186+italvi@users.noreply.github.com> Date: Thu, 16 May 2024 09:19:26 +0200 Subject: [PATCH 5/5] docs: add links to Jenkins and GitLab integrations used Signed-off-by: italvi <58322186+italvi@users.noreply.github.com> --- .../public/descriptions/CycloneDX-Editor-Validator-Tool.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md b/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md index 079188c..ad2d585 100644 --- a/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md +++ b/SBOM-Catalog/public/descriptions/CycloneDX-Editor-Validator-Tool.md @@ -7,4 +7,4 @@ The documentation is provided as [GitHub pages](https://festo-se.github.io/cyclo - Validate: Validates an SBOM against a given specification. The tool is deployed with the default CycloneDX schema and a custom schema, but a path to schema can also be provided. - Set: Using the command-line or a json, you can set properties on specified components in an SBOM, e.g. when information in an automtically created SBOM is missing or not correct. - Build-public: Remove components and information with namespace internal and resolves the dependencies. -- CI-/CD-Integration: As this is a command-line tool, it can be integrated into your pipelines and the validation even provide a report, which can be used by the `warnings-ng-plugin` from Jenkins or a `code-quality-report` as required by GitLab. +- CI-/CD-Integration: As this is a command-line tool, it can be integrated into your pipelines and the validation even provide a report, which can be used by the [`warnings-ng-plugin`](https://github.com/jenkinsci/warnings-ng-plugin) from Jenkins or a [`code-quality-report`](https://docs.gitlab.com/ee/ci/testing/code_quality.html#implement-a-custom-tool) as required by GitLab.