socket manifest cdxgen
Generate an SBOM of target directory using CycloneDX
This runs cdxgen, the CycloneDX SBOM generator, which will generate an SBOM of a directory of your choosing. This SBOM ("Software Bill of Materials") is a report of all the pieces that your software uses. This report can tell us what pieces of software you use so we can scan them for malware and report back to you.
We leverage cdxgen to generate this SBOM for various ecosystems. The command forwards your flags to cdxgen, so more details on flags, options, and usage are in the cdxgen documentation.
Note: all suggested cdxgen commands imply that you put "socket" before them, like socket cdxgen -t java
Socket-specific defaults and behaviorWhen invoked through Socket, a few cdxgen defaults differ from upstream cdxgen:
- Output is written to
socket-cdx.jsonby default (upstream cdxgen defaults tobom.json). Pass-o/--outputto override.- The lifecycle defaults to
--lifecycle pre-build, which disables--install-depsto avoid arbitrary code execution during the scan. Pass--lifecycle buildif you need a BOM that includes information obtained during the build.- The project type defaults to
jswhen-t/--typeis not provided.A few more things to know:
- Socket runs the cdxgen version pinned by your Socket CLI release and downloads it when needed with
npx,pnpm dlx, oryarn dlx, depending on your project's lockfile.socket cdxgen --helpprints the cdxgen version.- Pass the target directory as
.or as a path starting with./,../, or/, like./proj. A bare name likeprojis rejected as an unknown argument.- Socket only forwards the cdxgen flags it knows about. Unknown flags, such as
--project-tag,--include-regex, or--exclude-regex, are rejected. Use--excludein place of--exclude-regex.-cis Socket's own--configflag, so use--resolve-classin its place.
$ socket manifest cdxgen --help
CycloneDX Generator 12.1.2
cdxgen [command]
Commands:
cdxgen completion Generate bash/zsh completion
Options:
-o, --output Output file. Default bom.json [default: "bom.json"]
-t, --type Project type. Please refer to https://cdxgen.github.io/cdxgen/#/PROJECT_TYPES for
supported languages/platforms. [array]
--exclude-type Project types to exclude. Please refer to
https://cdxgen.github.io/cdxgen/#/PROJECT_TYPES for supported languages/platforms.
-r, --recurse Recurse mode suitable for mono-repos. Defaults to true. Pass --no-recurse to disable.
[boolean] [default: true]
-p, --print Print the SBOM as a table with tree. [boolean]
-c, --resolve-class Resolve class names for packages. jars only for now. [boolean]
--deep Perform deep searches for components. Useful while scanning C/C++ apps, live OS and
oci images. [boolean]
--server-url Dependency track url. Eg: https://deptrack.cyclonedx.io
--skip-dt-tls-check Skip TLS certificate check when calling Dependency-Track. [boolean] [default: false]
--api-key Dependency track api key
--project-group Dependency track project group
--project-name Dependency track project name. Default use the directory name
--project-version Dependency track project version [string] [default: ""]
--project-tag Dependency track project tag. Multiple values allowed.
--project-id Dependency track project id. Either provide the id or the project name and version
together [string]
--parent-project-id Dependency track parent project id [string]
--required-only Include only the packages with required scope on the SBOM. Would set
compositions.aggregate to incomplete unless --no-auto-compositions is passed.[boolean]
--fail-on-error Fail if any dependency extractor fails. [boolean]
--no-babel Do not use babel to perform usage analysis for JavaScript/TypeScript projects.
[boolean]
--generate-key-and-sign Generate an RSA public/private key pair and then sign the generated SBOM using JSON
Web Signatures. [boolean]
--server Run cdxgen as a server [boolean]
--server-host Listen address [default: "127.0.0.1"]
--server-port Listen port [default: "9090"]
--install-deps Install dependencies automatically for some projects. Defaults to true but disabled
for containers and oci scans. Use --no-install-deps to disable this feature.
[boolean] [default: true]
--validate Validate the generated SBOM using json schema. Defaults to true. Pass --no-validate to
disable. [boolean] [default: true]
--evidence Generate SBOM with evidence for supported languages. [boolean] [default: false]
--spec-version CycloneDX Specification version to use. Defaults to 1.6
[number] [choices: 1.4, 1.5, 1.6, 1.7] [default: 1.6]
--filter Filter components containing this word in purl or component.properties.value. Multiple
values allowed. [array]
--only Include components only containing this word in purl. Useful to generate BOM with
first party components alone. Multiple values allowed. [array]
--author The person(s) who created the BOM. Set this value if you're intending the modify the
BOM and claim authorship. [array] [default: "OWASP Foundation"]
--profile BOM profile to use for generation. Default generic.
[choices: "appsec", "research", "operational", "threat-modeling", "license-compliance", "generic", "machine-learning",
"ml", "deep-learning", "ml-deep", "ml-tiny"] [default: "generic"]
--include-regex glob pattern to include. This overrides the default pattern used during
auto-detection. [string]
--exclude, --exclude-regex Additional glob pattern(s) to ignore [array]
--export-proto Serialize and export BOM as protobuf binary. [boolean] [default: false]
--proto-bin-file Path for the serialized protobuf binary. [default: "bom.cdx"]
--include-formulation Generate formulation section with git metadata and build tools. Defaults to false.
[boolean] [default: false]
--include-crypto Include crypto libraries as components. [boolean] [default: false]
--standard The list of standards which may consist of regulations, industry or
organizational-specific standards, maturity models, best practices, or any other
requirements which can be evaluated against or attested to.
[array] [choices: "asvs-5.0", "asvs-4.0.3", "bsimm-v13", "masvs-2.0.0", "nist_ssdf-1.1", "pcissc-secure-slc-1.1",
"scvs-1.0.0", "ssaf-DRAFT-2023-11"]
--json-pretty Pretty-print the generated BOM json. [boolean] [default: false]
--min-confidence Minimum confidence needed for the identity of a component from 0 - 1, where 1 is 100%
confidence. [number] [default: 0]
--technique Analysis technique to use
[array] [choices: "auto", "source-code-analysis", "binary-analysis", "manifest-analysis", "hash-comparison",
"instrumentation", "filename"]
--auto-compositions Automatically set compositions when the BOM was filtered. Defaults to true
[boolean] [default: true]
-h, --help Show help [boolean]
-v, --version Show version number [boolean]
Examples:
cdxgen -t java . Generate a Java SBOM for the current directory
cdxgen -t java -t js . Generate a SBOM for Java and JavaScript in the current directory
cdxgen -t java --profile ml . Generate a Java SBOM for machine learning purposes.
cdxgen -t python --profile research . Generate a Python SBOM for appsec research.
cdxgen --server Run cdxgen as a server
for documentation, visit https://cdxgen.github.io/cdxgen(While you can add the manifest like socket manifest cdxgen ... you are welcome to drop it. We've made sure that socket cdxgen ... will work just as well!)
Updated about 1 month ago
Did this page help you?