diff --git a/sbom.md b/sbom.md index b31e24b..4f80809 100644 --- a/sbom.md +++ b/sbom.md @@ -88,3 +88,70 @@ Most used from this list: https://spdx.dev/use/spdx-tools/ | [ScanCode Toolkit](https://github.com/nexB/scancode-toolkit) | Simple and easy to install and use. Poor result. Packages not recognized but binaries. No licenses and vulnerabilities information. Difficult to evaluate the result. Graphical processing provided with external tool. | Further tests are therefore carried out with [Microsoft's SBOM Tool](https://github.com/microsoft/sbom-tool). + +## Pipeline Templates + +With [SBOM Tool Azure DevOps Extension](https://marketplace.visualstudio.com/items?itemName=rhyskoedijk.sbom-tool) a simple call as task with all needed parameters already exists. Therefore no template is required. + +## Documentation + +### Install Extension + +Appropriate permissions or an authorization are required for the installation of [SBOM Tool Azure DevOps Extension](https://marketplace.visualstudio.com/items?itemName=rhyskoedijk.sbom-tool). + +After installation a task in the pipeline can look like the following example: + +```yaml +- task: sbom-tool@1 + displayName: 'Generate SBOM Manifest' + inputs: + command: 'generate' + buildSourcePath: '$(Build.SourcesDirectory)' + buildArtifactPath: '$(Build.ArtifactStagingDirectory)' + enableManifestSpreadsheetGeneration: true + enableManifestGraphGeneration: true + enablePackageMetadataParsing: true + fetchLicenseInformation: true + fetchSecurityAdvisories: true + gitHubConnection: 'GitHubForSandbox' + packageSupplier: 'MyOrganisation' + packageName: 'MyPackage' + packageVersion: '$(Build.BuildNumber)' +``` + +A complete example: + +```yaml +jobs: + - job: publish + steps: + - task: DotNetCoreCLI@2 + displayName: 'Publish project' + inputs: + command: 'publish' + publishWebProjects: true + arguments: '--output "$(Build.ArtifactStagingDirectory)"' + + - task: sbom-tool@1 + displayName: 'Generate project SBOM manifest' + inputs: + command: 'generate' + buildSourcePath: '$(Build.SourcesDirectory)' + buildArtifactPath: '$(Build.ArtifactStagingDirectory)' + enableManifestSpreadsheetGeneration: true + enableManifestGraphGeneration: true + enablePackageMetadataParsing: true + fetchLicenseInformation: true + fetchSecurityAdvisories: true + gitHubConnection: 'GitHub Advisory Database Connection' + packageSupplier: 'MyOrganisation' + packageName: 'MyPackage' + packageVersion: '$(Build.BuildNumber)' + + - task: PublishBuildArtifacts@1 + displayName: 'Publish artifacts' + inputs: + PathtoPublish: '$(Build.ArtifactStagingDirectory)' + ArtifactName: 'drop' + publishLocation: 'Container' +``` \ No newline at end of file