Creating a Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a comprehensive list of the component parts required to build your project. This can include any open source libraries, plugins, extensions, and system packages. Immutable SBOMS are available in JSON and SPDX formats and can be created for any project or any commit in a project. All SBOMs follow the SPDX2.2 specifications.

An SBOM for your ActiveState project will record what is in your runtime, where it came from, and all the information you need to maintain a secure and safe development environment.

How to generate an SBOM (JSON format)

To generate a JSON format of your SBOM open a GraphQL query and replace the information in the angled brackets with your project’s information. The orgname and project name are case sensitive, and if you choose to not include a commit ID, delete commit_id:"<commit ID (optional)>" from the query.

{
  sbom(org:"<org name>"
    , name:"<project name>", 
    commit_id:"<commit ID (optional)>")
  {
    __typename
    ...on SBOM {
      author
      timestamp
      spdxUri
      components{
        name
        version
        supplier
        checksum
        license
        relationship
      }
    }	
  }
}

Clicking the triangular “play” button in the GraphQL UI will execute the command and return your SBOM in a JSON format.

How to generate an SBOM (SPDX format)

Click the Create SBOM button on the Overview or History tabs of your project page to download your SBOM in SPDX format. Your SBOM is machine-readable and will contain the following information at a project level:

• SPDX Version number for the document
• Data license
• SPDXID for the project to refer to itself in relation to other elements
• Project name (seen as “DocumentName”)
• A download location for the project
• The name of the organization that created the SBOM
• Date and time of the SBOM data assembly

And the following information at the package or component level:

• Package name
• Specific SPDXID used to reference throughout the document. Scrolling to the end of the document will show package relationships using the SPDXID for reference
• Package version
• Package download location
• SHA-256 checksum
• Package license or copyright information (if the information is found but cannot be verified, NOASSERTION will be shown)

An example excerpt is shown below

SPDXVersion: SPDX-2.2
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: APEE-534-Microsoft-Rlc-NoPMC-Athnticode
DocumentNamespace: https://platform.activestate.com/download/spdx/ActiveStateBE/APEE-534-Microsoft-Rlc-NoPMC-Athnticode/e73ad540-0072-4d50-845a-03844c0a74fe
Creator: Organization: ActiveState
Created: 2022-06-02T22:31:01Z

PackageName: perl
SPDXID: SPDXRef-perl
PackageVersion: 5.34.0
PackageDownloadLocation: https://dl.activestate.com/source/ed4b2154-eaee-5fba-88bb-d1eca86b1206/versions/0fbbfdd6-68e5-5f06-86ce-b03395e79c54/revisions/5/perl-5.34.0.tar.gz
FilesAnalyzed: false
PackageChecksum: SHA256: 551efc818b968b05216024fb0b727ef2ad4c100f8cb6b43fab615fa78ae5be9a
PackageLicenseConcluded:  GPL-1.0-or-later
PackageLicenseConcluded: Artistic-1.0-Perl
PackageLicenseDeclared: NOASSERTION
PackageLicenseInfoFromFiles:  GPL-1.0-or-later
PackageLicenseInfoFromFiles: Artistic-1.0-Perl
PackageCopyrightText: NOASSERTION

You can use the information in your SBOM as part of an effective strategy to mitigate software vulnerabilities, assure your runtime is secure and up to date, and in compliance with provided specifications and/or governmental standards. For more information about SBOMs and why they are important to your project see our datasheet on Open Source Security With A Bill of Materials