Skip to content

Latest commit

 

History

History
146 lines (113 loc) · 3.81 KB

creating-binary-file-sbom.md

File metadata and controls

146 lines (113 loc) · 3.81 KB
Raw

Creating SBOMs From Binary Files Using Sufactant

Introduction

This tutorial illustrates how to create an SBOM from binary files (PE, ELF, MSI) using the Surfactant CLI.

Requirements

  • Python3

  • Pip

Installation

Install Surfactant by running:

pip install surfactant

Usage

Configuration File

Surfactant requires a configuration file to generate an SBOM. A basic configuration file can be created via the command:

surfactant create-config input-folder-path -o output-configuration-file-name.json

This results in a basic configuration file akin to that shown below:

[
    {
        "extractPaths": ["input-folder-path"],
        "installPrefix": "/"
    }
]

This file should be modified to point to the location of selected binaries within that you wish to include in your SBOM, for example:

[
    {
        "extractPaths": ["input-folder-path/subpath-to-binary-folder-1", "input-folder-path/subpath-to-binary-folder-2"],
        "installPrefix": "/"
    }
]

Generating an SBOM

With a configuration file created, an SBOM can be created via the command:

surfactant generate <configuration-file-pathname> <output-file-pathname> --output_format <output-format>

Where output-format can be one of:

  • cytrics
  • csv
  • cyclonedx
  • spdx

An SBOM of your designated format will be created.

Notes

  • This SBOM generator, in addition to having the capacity to output SBOMs in CycloneDX and SPDX, generates SBOMs in CyTRICS, a BOM format created by the Office of Cybersecurity, Energy Security, and Emergency Response of the US Department of Energy.

  • The SPDX generation functionality of this tool may not be reliable.

SBOM

<title>Pretty JSON Display</title> <style> #json-container { height: 400px; /* Set a fixed height */ overflow-y: auto; /* Enable vertical scrolling */ border: 2px solid #ccc; /* Optional: add a border for visibility */ padding: 10px; } #xml-container { height: 400px; /* Set a fixed height */ overflow-y: auto; /* Enable vertical scrolling */ border: 2px solid #ccc; /* Optional: add a border for visibility */ padding: 10px; } pre { margin: 0; white-space: pre-wrap; word-wrap: break-word; } </style>

Helics (cyclonedx-json) 


    

    

        Helics (cytrics-json)
    

    

        

    

    <script>
        function display_json(url, elementid){
        fetch(url)
            .then(response => response.json())
            .then(data => {
                document.getElementById(elementid).textContent = JSON.stringify(data, null, 2);
            })
            .catch(error => console.error('Error fetching JSON:', error));
        }
        function display_xml(url, elementid){
        fetch(url)
            .then(response => response.text())
            .then(data => {
                document.getElementById(elementid).textContent = data;
            })
            .catch(error => console.error('Error fetching XML:', error));
        }
    display_json('Helics-3.5.2-linux_x86.cdx.json', 'json-display1');
    display_json('Helics-3.5.2-linux_x86.cytrics.json', 'json-display2');
    </script>



References