Skip to content

Export SBOM manifest file

Adam Cohen requested to merge 352199-test-isbom into master

What does this MR do?

This MR adds support for outputting an sbom-manifest.json file which contains references to the generated SBOM files, as well as additional metadata, for example:

{
  "version": "0.0.1",
  "analyzer": {
    "id": "gemnasium-python",
    "version": "2.23.0"
  },
  "components": [
    {
      "project": {
        "path": "."
      },
      "package_type": "pypi",
      "package_manager": "pip",
      "language": "Python",
      "files": [
        {
          "type": "sbom",
          "path": "cyclonedx-pypi-pip.json"
        },
        {
          "type": "input",
          "path": "requirements.txt"
        }
      ]
    }
  ],
  "timestamp": "2022-04-13T05:43:57Z"
}

What are the relevant issue numbers?

Determine ISBOM manifest file structure (gitlab-org/gitlab#352199 - closed)

Does this MR meet the acceptance criteria?

Edited by Adam Cohen

Merge request reports