cyclonedx-bom

The CycloneDX library provides JSON and XML serialization and deserialization of Software Bill-of-Materials (SBOM) files.

CycloneDX is a full-stack SBOM/xBOM standard designed for use in application security contexts and supply chain component analysis.

The library is intended to enable developers to:

• Construct SBOM documents that conform the CycloneDX specification
• Parse and validate JSON and XML SBOM documents
• Perform modifications to BOM documents (e.g. merging multiple BOMs using a variety of algorithms)

Supported CycloneDX versions

This library currently supports CycloneDX 1.3, 1.4 and 1.5.

Usage

Read and validate an SBOM

use cyclonedx_bom::prelude::*;

let bom_json = r#"{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1
}"#;
let bom = Bom::parse_from_json_v1_5(bom_json.as_bytes()).expect("Failed to parse BOM");

let validation_result = bom.validate();
assert!(validation_result.passed());

Create and output an SBOM

use cyclonedx_bom::prelude::*;
use cyclonedx_bom::models::{
    tool::{Tool, Tools},
};

let bom = Bom {
    serial_number: Some(
        UrnUuid::new("urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79".to_string())
            .expect("Failed to create UrnUuid"),
    ),
    metadata: Some(Metadata {
        tools: Some(Tools::List(vec![Tool {
            name: Some(NormalizedString::new("my_tool")),
            ..Tool::default()
        }])),
        ..Metadata::default()
    }),
    ..Bom::default()
};

let mut output = Vec::<u8>::new();

bom.output_as_json_v1_5(&mut output)
    .expect("Failed to write BOM");
let output = String::from_utf8(output).expect("Failed to read output as a string");
assert_eq!(
    output,
    r#"{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "metadata": {
    "tools": [
      {
        "name": "my_tool"
      }
    ]
  }
}"#
);

Verification and Validation

See README for details.

Contributing

See CONTRIBUTING for details.

Bug Bounty

We are running a Bug Bounty program financed by the Bug Resilience Program of the Sovereign Tech Fund. Thank you very much!

Copyright & License

CycloneDX Rust Cargo is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.