Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
b3822c57
Commit
b3822c57
authored
Mar 01, 2022
by
Adam Cohen
Committed by
Russell Dickenson
Mar 01, 2022
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Rename CycloneDX report to SBOM in docs
parent
848a02bf
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
14 additions
and
14 deletions
+14
-14
doc/user/application_security/dependency_scanning/index.md
doc/user/application_security/dependency_scanning/index.md
+14
-14
No files found.
doc/user/application_security/dependency_scanning/index.md
View file @
b3822c57
...
...
@@ -767,13 +767,13 @@ Here's an example dependency scanning report:
}
```
### CycloneDX
report
s
### CycloneDX
Software Bill of Material
s
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/350509) in GitLab 14.8 in [Beta](../../../policy/alpha-beta-support.md#beta-features).
In addition to the
[
JSON report file
](
#reports-json-format
)
, the
[
Gemnasium
](
https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium
)
Dependency Scanning tool outputs a
[
CycloneDX
](
https://cyclonedx.org/
)
report
for
each supported lock or build file it detects. These CycloneDX
report
s are named
Dependency Scanning tool outputs a
[
CycloneDX
](
https://cyclonedx.org/
)
Software Bill of Materials (SBOM)
for
each supported lock or build file it detects. These CycloneDX
SBOM
s are named
`cyclonedx-<package-type>-<package-manager>.json`
, and are saved in the same directory
as the detected lock or build files.
...
...
@@ -791,7 +791,7 @@ For example, if your project has the following structure:
└── go.sum
```
Then the Gemnasium scanner generates the following CycloneDX
report
s:
Then the Gemnasium scanner generates the following CycloneDX
SBOM
s:
```
plaintext
.
...
...
@@ -809,23 +809,23 @@ Then the Gemnasium scanner generates the following CycloneDX reports:
└── cyclonedx-go-go.json
```
The CycloneDX
report
s can be downloaded
[
the same way as other job artifacts
](
../../../ci/pipelines/job_artifacts.md#download-job-artifacts
)
.
The CycloneDX
SBOM
s can be downloaded
[
the same way as other job artifacts
](
../../../ci/pipelines/job_artifacts.md#download-job-artifacts
)
.
### Merging multiple CycloneDX
Report
s
### Merging multiple CycloneDX
SBOM
s
You can use a CI/CD job to merge multiple CycloneDX
Reports into a single report
.
You can use a CI/CD job to merge multiple CycloneDX
SBOMs into a single SBOM
.
For example:
```
yaml
stages
:
-
test
-
merge-cyclonedx-
report
s
-
merge-cyclonedx-
sbom
s
include
:
-
template
:
Security/Dependency-Scanning.gitlab-ci.yml
merge cyclonedx
report
s
:
stage
:
merge-cyclonedx-
report
s
merge cyclonedx
sbom
s
:
stage
:
merge-cyclonedx-
sbom
s
image
:
alpine:latest
script
:
-
wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-musl-x64 -O /usr/local/bin/cyclonedx-cli
...
...
@@ -838,14 +838,14 @@ merge cyclonedx reports:
```
GitLab uses
[
CycloneDX Properties
](
https://cyclonedx.org/use-cases/#properties--name-value-store
)
to store implementation-specific details in the metadata of each CycloneDX
report
,
such as the location of build and lock files. If multiple CycloneDX
report
s are merged together,
to store implementation-specific details in the metadata of each CycloneDX
SBOM
,
such as the location of build and lock files. If multiple CycloneDX
SBOM
s are merged together,
this information is removed from the resulting merged file.
NOTE:
CycloneDX
report
s are a
[
Beta
](
../../../policy/alpha-beta-support.md#beta-features
)
feature,
CycloneDX
SBOM
s are a
[
Beta
](
../../../policy/alpha-beta-support.md#beta-features
)
feature,
and the reports are subject to change during the beta period. Do not build integrations
that rely on the format of these
report
s staying consistent, as the format might change
that rely on the format of these
SBOM
s staying consistent, as the format might change
before the feature is made generally available.
## Versioning and release process
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment