What is CycloneDX?

CycloneDX, developed by the Open Web Application Security Project (OWASP), is an open common standard for communicating SBOM information, a data format.

Dependency relations

In the dependencies array, you can find a reference number (ref) for each component and an array of each direct dependency of that dependency (depends_on). The roots of the relational trees will reference to the files in the project, together with the direct dependencies that it contains. By traversing the dependencies array, it is possible to build the entire dependency tree.

In example below, you can see the direct dependency `webpack:4.28.4` depending on `terser-webpack-plugin:1.2.1` which in turn depends on `terser:3.14.1`.

Here is how this would be visualised in the user interface:

Root fixes

Under Recommendation, you can find information about the first version of the specific vulnerable dependency that is safe, as well as the first version of the root or direct dependency that does not contain a vulnerable version of the indirect dependency. See example below:

What is an SBOM?

A Software Bill of Materials (SBOM) is a record of the supply chain relationships between the components used when creating software. The record lists all components of a product, including all open source software, which can be helpful for both the developers and other stakeholders, such as investors and legal teams.

The SBOM includes the following data points:

• Proof of license - A reference to the source from where the license information is fetched. This field is applicable only for CycloneDX SBOM.

• License text - The actual text that the license consists of. This field is applicable only for CycloneDX SBOM.

• Copyright statement - Displays the person or organization who holds the copyright.

• Open Source Selectlink - A link to the dependency page in Open Source Select, where you can find additional information on the specific open-source package.

Keep in mind that license information may differ depending on the package and the specific version used.

Export a CycloneDX or SPDX SBOM using web tool

In order to generate the CycloneDX or SPDX SBOM Export:

1. Click Generate export on the top right corner of the page.

2. Under Scope, choose one of the following options:

   1. Global export: Export the SBOM for all repositories you have access to.

   2. Repositories: Select specific repositories for which you want to view the data and then choose the corresponding branch. If you select multiple repositories, the

Export a CycloneDX or SPDX SBOM using web tool - video guide

Export a CycloneDX or SPDX SBOM to email using API

If you have already integrated your repository with OpenText Core SCA, you can generate a CycloneDX or SPDX SBOM by fetching your data through the API.

To use OpenText Core SCA REST API, you should authenticate first.

Endpoint: /api/{1.0}/open/sbom/generate

Following is an example of a request using curl to generate an SPDX SBOM (to generate a CycloneDX SBOM use "format": "CycloneDX"):

You can send the following parameters in the body of the request: commitId, email, repositoryIds, branch, locale. You can choose to add license and vulnerability data, using licenses: true/false and vulnerabilities: true/false.

If you provide a commitId, the branch and repositoryIds will be ignored. If you leave the branch field empty, the report is generated for the identified default branch (most likely 'main' or 'master', if applicable) of the selected repository. It is also possible to create an SBOM for all repositories by not specifying any repositoryIds.

Once you send the request, you will receive your SBOM via email, which will be sent to you in the .json format. If you can’t find the email in your inbox, make sure to check the SPAM folder. If you do not provide an email address, the SBOM will be sent to the email of the user who created the request.

Export a CycloneDX or SPDX SBOM to email using API - video guide

Export a CycloneDX or SPDX SBOM directly from API

It is also possible to generate a CycloneDX or SPDX SBOM and download it directly through the API. As part of the response of the /api/1.0/open/sbom/generate endpoint, a reportUuid is sent, which can be used in the /api/1.0/open/sbom/download endpoint.

Following is an example response from the /api/1.0/open/sbom/generate endpoint:

Following is an example request for the /api/1.0/open/sbom/download endpoint:

If you do not want the report to also be sent to your email, it is possible to turn this off by setting the "sendEmail" value to "false" in the /api/1.0/open/sbom/generate endpoint.

Click the following link for an example on exporting CycloneDX SBOM:

Click the following link to view the list of commands to create an SBOM using the CLI.

What is SPDX?

SPDX is an open standard for communicating software bill of material information, including provenance, license, security, and other related information. SPDX reduces redundant work by providing common formats for organizations and communities to share important data, thereby streamlining and improving compliance, security, and dependability.

Dependency relations

The relationships between components are presented in the relationships array. OpenText Core SCA SPDX SBOMs support following two types of relationship objects:

• DESCRIBES which is used for declaring each file and dependency component in the BOM.

• DEPENDENCY_OF which denotes a direct relationship between two components.

In the objects describing the direct dependencies of a file, the 'relatedSpdxElement' will contain the reference of that file. Relationships between dependencies will instead reference the parent dependency. By traversing the dependencies array, it is possible to build the entire dependency tree.

In the example below, you can see direct dependency `webpack-4.28.4` referenced as a dependency of a file. Component `terser-webpack-plugin-1.2.1` is in turn referenced as a dependency of `webpack-4.28.4` and lastly, `terser-3.14.1` is a dependency of `terser-webpack-plugin-1.2.1`.

Here is how this would be visualised in the user interface: