02 - SBOM Generation and Vulnerability Management

Generating SBOMs

You can automatically generate an SBOM for your project, container, or filesystem using open-source tools like Syft.

Syft / CycloneDX

Syft is a powerful tool to generate SBOMs from container images and filesystems.

Generate a CycloneDX SBOM for a directory:

syft dir:. -o cyclonedx-json > sbom.json

Generate an SPDX SBOM for a Docker image:

syft alpine:latest -o spdx-json > alpine-sbom.json

Example output (abridged CycloneDX JSON):

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "version": 1,
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.17.1",
      "purl": "pkg:npm/express@4.17.1"
    }
  ]
}

Vulnerability Scanning

Once you have an SBOM, you can scan it against vulnerability databases.

Grype

Grype is a vulnerability scanner for container images and filesystems. It can consume the SBOMs produced by Syft.

Scan an SBOM with Grype:

grype sbom:sbom.json

Trivy

Trivy is a comprehensive scanner for vulnerabilities, misconfigurations, secrets, and SBOMs in containers, Kubernetes, code repositories, and clouds.

Scan a repository and generate a CycloneDX SBOM:

trivy fs . --format cyclonedx --output trivy-sbom.json

Scan a Docker image:

trivy image my-app:latest

Managing VEX (Vulnerability Exploitability eXchange)

Not all vulnerabilities in dependencies affect your application. If you never call the vulnerable function, it might not be exploitable.

VEX is a companion artifact to an SBOM. It provides a machine-readable format to assert the status of specific vulnerabilities in a specific product.

VEX Statuses:

• Not Affected: No remediation is required.
• Affected: Actions are recommended to remediate or address this vulnerability.
• Fixed: This product versions contain a fix for the vulnerability.
• Under Investigation: It is not yet known whether these product versions are affected.

By publishing a VEX document alongside your SBOM, you save your customers from worrying about false positives.