Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CycloneDX Editor Validator Tool by Festo #52

Merged
merged 5 commits into from
May 21, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion SBOM-Catalog/public/data.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -564,4 +564,17 @@
Type:
- Source
Language:
- Cargo
- Cargo

- Name: CycloneDX-Editor-Validator-Tool
Link: https://github.com/Festo-se/cyclonedx-editor-validator
Publisher: Festo
License: OpenSource
Standards:
- CycloneDx
Abilities:
- Edit
- Merge
- Validate
Type:
Language:
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
The [CycloneDX Editor Validator Tool](https://github.com/Festo-se/cyclonedx-editor-validator) is designed as a command-line tool to perform various actions on CycloneDX SBOMs. It allows you to modify, merge and validate your SBOMs.
The documentation is provided as [GitHub pages](https://festo-se.github.io/cyclonedx-editor-validator/). Tne tool can be installed via [pypi](https://pypi.org/project/cyclonedx-editor-validator/).

## Key Features and Capabilities:
- Amend: Adds missing auto-generatable information to an existing SBOM.
- Merge: Merges two or more SBOMs into one.
- Validate: Validates an SBOM against a given specification. The tool is deployed with the default CycloneDX schema and a custom schema, but a path to schema can also be provided.
- Set: Using the command-line or a json, you can set properties on specified components in an SBOM, e.g. when information in an automtically created SBOM is missing or not correct.
- Build-public: Remove components and information with namespace internal and resolves the dependencies.
- CI-/CD-Integration: As this is a command-line tool, it can be integrated into your pipelines and the validation even provide a report, which can be used by the [`warnings-ng-plugin`](https://github.com/jenkinsci/warnings-ng-plugin) from Jenkins or a [`code-quality-report`](https://docs.gitlab.com/ee/ci/testing/code_quality.html#implement-a-custom-tool) as required by GitLab.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.