App-CPAN-SBOM

 view release on metacpan or  search on metacpan

README.md  view on Meta::CPAN

      --project-name NAME               Project name (default: project directory name)
      --project-version VERSION         Project version
      --project-author STRING           Project author(s)
      --project-license SPDX-LICENSE    Project SPDX license
      --project-description TEXT        Project description                  

      --maxdepth=NUM                    Max depth (default: 1)
      --vulnerabilities                 Include Module/Distribution vulnerabilities
      --no-vulnerabilities

      --validate                        Validate the generated SBOM using JSON Schema (default: true)
      --no-validate

      --list-spdx-licenses              List SPDX licenses

      --debug                           Enable debug messages

      --help                            Brief help message
      --man                             Full documentation
  -v, --version                         Print version

OWASP Dependency Track options:

bin/cpan-sbom  view on Meta::CPAN

          --project-name NAME               Project name (default: project directory name)
          --project-version VERSION         Project version
          --project-author STRING           Project author(s)
          --project-license SPDX-LICENSE    Project SPDX license
          --project-description TEXT        Project description                  

          --maxdepth=NUM                    Max depth (default: 1)
          --vulnerabilities                 Include Module/Distribution vulnerabilities
          --no-vulnerabilities

          --validate                        Validate the generated SBOM using JSON Schema (default: true)
          --no-validate

          --list-spdx-licenses              List SPDX licenses

          --debug                           Enable debug messages

          --help                            Brief help message
          --man                             Full documentation
      -v, --version                         Print version

    OWASP Dependency Track options:

lib/App/CPAN/SBOM.pm  view on Meta::CPAN

            debug|d

            output|o=s

            meta=s
            distribution=s

            maxdepth=i

            vulnerabilities!
            validate!

            project-meta=s
            project-type=s
            project-author=s@
            project-description=s
            project-directory=s
            project-license=s
            project-name=s
            project-version=s

lib/App/CPAN/SBOM.pm  view on Meta::CPAN

    if ($options{'list-spdx-licenses'}) {
        say $_ for (sort @{SBOM::CycloneDX::Enum->SPDX_LICENSES});
        return 0;
    }

    unless ($options{distribution} || $options{'project-meta'} || $options{'project-directory'}) {
        pod2usage(-exitstatus => 0, -verbose => 0);
    }

    $options{maxdepth} //= 1;
    $options{validate} //= 1;

    if (defined $options{debug}) {
        $ENV{SBOM_DEBUG} = 1;
    }

    my $bom = SBOM::CycloneDX->new;

    if (defined $options{distribution}) {

        my ($distribution, $version) = split '@', $options{distribution};

lib/App/CPAN/SBOM.pm  view on Meta::CPAN

    $bom->metadata->tools->push(cyclonedx_tool());

    my $output_file = $options{output} // 'bom.json';

    say STDERR "Save SBOM to $output_file";

    open my $fh, '>', $output_file or Carp::croak "Failed to open file: $!";
    say $fh $bom->to_string;
    close $fh;

    if ($options{validate}) {
        my @errors = $bom->validate;
        say STDERR $_ foreach (@errors);
    }

    if (defined $options{'server-url'} && defined $options{'api-key'}) {
        submit_bom(bom => $bom, options => \%options);
    }

}

sub show_version {