Currently SBOMs are only available to Enterprise tier account holders, for more information on accounts check here
A Software Bill of Materials (SBOM) is a comprehensive list of the component parts required to build your project. This can include any open source libraries, plugins, extensions, and system packages. You can create an immutable SBOM for any project or any commit in a project.
The SBOM for your ActiveState project will record what is in your runtime, where it came from, and all the information you need to maintain a secure and safe development environment.
SBOMs at ActiveState follow the SPDX2.2 specification and are available in JSON and SPDX formats.
To generate a JSON format of your SBOM open a GraphQL query and replace the information in the angled brackets (and the brackets themselves) with your project’s information:
{
sbom(org:"<org name>"
, name:"<project name>",
commit_id:"<commit ID (optional)>")
{
__typename
...on SBOM {
author
timestamp
spdxUri
components{
name
version
supplier
checksum
license
relationship
}
}
}
}
Clicking the triangular “play” button in the GraphQL UI will execute the command and return your SBOM in a JSON format.
To convert your SBOM from a JSON to SPDX format, you will need to generate a new JSON Web Token (JWT).
Using the State tool, run state export jwt
to generate a new JWT. You can also generate a new JWT directly from the ActiveState API.
Run the following curl command, replacing the information in the angled brackets with your SPDXURI (found at the bottom of your JSON version) and your newly generated JWT string:
curl -X GET
"<insert URL in spdxUri from JSON formatted SBOM without angle brackets>"
-H "Authorization: Bearer <insert jwt string without angle brackets>" -L >msft.spdx
This command will return an SPDX version of your SBOM that is machine-readable and will contain the following information at a project level:
And the following information at the package or component level:
NOASSERTION
will be shown)SPDXVersion: SPDX-2.2
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: APEE-534-Microsoft-Rlc-NoPMC-Athnticode
DocumentNamespace: https://platform.activestate.com/download/spdx/ActiveStateBE/APEE-534-Microsoft-Rlc-NoPMC-Athnticode/e73ad540-0072-4d50-845a-03844c0a74fe
Creator: Organization: ActiveState
Created: 2022-06-02T22:31:01Z
PackageName: perl
SPDXID: SPDXRef-perl
PackageVersion: 5.34.0
PackageDownloadLocation: https://dl.activestate.com/source/ed4b2154-eaee-5fba-88bb-d1eca86b1206/versions/0fbbfdd6-68e5-5f06-86ce-b03395e79c54/revisions/5/perl-5.34.0.tar.gz
FilesAnalyzed: false
PackageChecksum: SHA256: 551efc818b968b05216024fb0b727ef2ad4c100f8cb6b43fab615fa78ae5be9a
PackageLicenseConcluded: GPL-1.0-or-later
PackageLicenseConcluded: Artistic-1.0-Perl
PackageLicenseDeclared: NOASSERTION
PackageLicenseInfoFromFiles: GPL-1.0-or-later
PackageLicenseInfoFromFiles: Artistic-1.0-Perl
PackageCopyrightText: NOASSERTION
You can use the information in your SBOM as part of an effective strategy to mitigate software vulnerabilities, assure your runtime is secure and up to date, and in compliance with provided specifications and/or governmental standards.
For more information about SBOMs and why they are important to your project: