From c80bbf2bd5cafed2b24d6bc0244a2fdd04b22bb9 Mon Sep 17 00:00:00 2001 From: Avishagp Date: Wed, 12 Apr 2023 12:07:03 +0000 Subject: [PATCH] docs: synchronizing help from snyk/user-docs --- help/cli-commands/sbom.md | 66 +++++++++++++++++++++++++++++---------- 1 file changed, 49 insertions(+), 17 deletions(-) diff --git a/help/cli-commands/sbom.md b/help/cli-commands/sbom.md index 0c439190c2..36014a3bc0 100644 --- a/help/cli-commands/sbom.md +++ b/help/cli-commands/sbom.md @@ -1,16 +1,24 @@ # SBOM -## Usage +## Prerequisites **Feature availability:** This feature is available to customers on Snyk Enterprise plans. **Note:** In order to run the SBOM generation feature, you must use a minimum of CLI version 1.1071.0. -`$ snyk sbom --format=|spdx2.3+json [--file=] [--unmanaged] [--org=] []` +The `snyk sbom` feature requires an internet connection. + +## Usage + +`$ snyk sbom --format=|spdx2.3+json> [--file=] [--unmanaged] [--org=] []` ## Description -The `snyk sbom` command enables you to produce an SBOM for a local software project in an ecosystem supported by Snyk. +The `snyk sbom` command generates an SBOM for a local software project in an ecosystem supported by Snyk. + +Supported formats include CycloneDX v1.4 (JSON or XML) and SPDX v2.3 (JSON). + +An SBOM can be generated for all supported Open Source package managers as well as unmanaged software projects. ## Exit codes @@ -27,34 +35,40 @@ Use the `-d` option to output the debug logs. ### `--format=` -Specify the output format for the SBOM to be produced. +Required. Specify the output format for the SBOM to be produced. -The supported formats are CycloneDX 1.4 JSON or XML and SPDX 2.3 JSON. +Set the desired SBOM output format. Available options are `cyclonedx1.4+json`, `cyclonedx1.4+xml`, and `spdx2.3+json` -### `[--file=]` +### `[--org=]` -Optional. Select the package manager manifest file to use as the basis for the SBOM to be produced. +Specify the `` (name or UUID) to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits. -### `[--unmanaged]` +Use this option when your default organization does not have API entitlement. -Optional. Instruct the CLI to build an SBOM based on the unmanaged C/C++ source libraries that are locally available. +If this option is omitted, the default organization for your account will be used. -### `[--org=]` +This is the `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account) -Optional. Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits. +Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option. If you have multiple organizations, you can set a default from the CLI using: `$ snyk config set org=` -Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option. - -Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account) - **Note:** You can also use `--org=.` The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API. For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI) +### `[--file=] or [--f=]` + +Specify the desired manifest file on which the SBOM will be based. + +By default, the `sbom` command detects a supported manifest file in the current working directory. + +### `[--unmanaged]` + +Generate an SBOM for unmanaged software projects. + ### `[]` Optional. Instruct the CLI to autodetect a package manager manifest file to use within the specified directory. If `--file` is set, this option will be ignored. @@ -63,10 +77,28 @@ Optional. Instruct the CLI to autodetect a package manager manifest file to use ## Examples for the snyk sbom command -Generate an SBOM and display it in the local console. +### Create a CycloneDX JSON document for a local software project `$ snyk sbom --format=cyclonedx1.4+json` -Generate an SBOM and write it to a local file. +### Create a CycloneDX JSON document and write it to a local file `$ snyk sbom --format=cyclonedx1.4+json > mySBOM.json` + +### Create an SPDX 2.3 JSON document for an unmanaged software project + +```bash +$ snyk sbom --unmanaged --format=spdx2.3+json +``` + +### Create a CycloneDX XML document for a Maven project + +``` +$ snyk sbom --file=pom.xml --format=cyclonedx1.4+xml +``` + +### **Create a CycloneDX JSON document and scan using bomber and Snyk** + +
$ snyk sbom --format=cyclonedx1.4+json --file=go.mod > /tmp/sbom.cdx.json && \
+  bomber scan --provider snyk --token $SNYK_API_TOKEN /tmp/sbom.cdx.json
+