The GitHub CLI extension can be installed by running gh ext install advanced-security/gh-sbom.
There exist many tools, both commercial and open-source, that can be used to consume SPDX files to validate, analyze, or convert them to other formats.īesides using the GitHub Web UI, it is also possible to export SBOMs using a GitHub CLI's extension or a GitHub Action. SPDX, short for Software Package Data Exchange, is an open format specifically defined to describe a software bill of materials, including any dependencies, licenses, copyrights, and security references. This will create a machine-readable SBOM in the SPDX format. To generate the SBOM manually, you visit the dependency graph of your repository and click the new Export SBOM button. Users can export SBOMs in a number of different ways, either manually or through an automated process. The new feature allows you to export NTIA-compliant SBOM easily, says GitHub. GitHub has announced a new SBOM export feature meant to be used as part of security compliance workflows and tools.
0 kommentar(er)
