cyclonedx / cyclonedx-ruby-gem

Creates CycloneDX Software Bill of Materials (SBOM) from Ruby projects

CycloneDX Ruby Gem

The CycloneDX Ruby Gem creates a valid CycloneDX Software Bill of Materials (SBOM) from all project dependencies. CycloneDX is a lightweight SBOM specification that is easily created, human readable, and simple to parse.

Installing from RubyGems

gem install cyclonedx-ruby 

Building and Installing From Source

gem build cyclonedx-ruby.gemspec
gem install cyclonedx-ruby-x.x.x.gem 

Usage

cyclonedx-ruby [options]

`-v, --[no-]verbose` Run verbosely
`-p, --path path` Path to Ruby project directory
`-f, --format` Bom output format
`-h, --help` Show help message

Output: bom.xml or bom.json file in project directory

Example

cyclonedx-ruby -p /path/to/ruby/project

Copyright & License

CycloneDX Ruby Gem is Copyright (c) OWASP Foundation. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.

cyclonedx-ruby-gem's Issues

Add support for metadata introduced in CycloneDX v1.1

:mega: Looking for contributors and maintainers

CycloneDX is a community effort.

If you want to help out, become a contributor or maintainer, please let us know.
Just ping here, or even better: join our slack via https://cyclonedx.org/slack/invite

Add support for metadata information

https://cyclonedx.org/docs/1.4/json/#metadata

invalid option: --format

$ cyclonedx-ruby --path . --format json
/bundle/gems/cyclonedx-ruby-1.1.0/lib/bom_builder.rb:68:in `setup': invalid option: --format (OptionParser::InvalidOption)
	from /bundle/gems/cyclonedx-ruby-1.1.0/lib/bom_builder.rb:15:in `build'
	from /bundle/gems/cyclonedx-ruby-1.1.0/bin/cyclonedx-ruby:4:in `<top (required)>'
	from /bundle/bin/cyclonedx-ruby:23:in `load'
	from /bundle/bin/cyclonedx-ruby:23:in `<main>'

format is in readme.md, but didn't work

Add support for dependency graph introduced in v1.2 of the spec

Copyright & License

I have a question about Copyright & License!
I have already created a gem that is working, should I include the Copyright & License notice at the head of each file, or should I simply create a PR with the code I have and then we'll add that stuff later on before we merge it?
I'm not really familiar how this stuff work

Add support for JSON output

In preparation of v1.2 of the spec we need to support JSON output.

Lack of dependencies in cyclonedx-ruby.gemspec file causing runtime issues if client does not have appropriate dependent gems installed

The cyclonedx-ruby.gemspec file does not have any dependencies defined using s.add_runtime_dependency or s.add_development_dependency. If a user does not have a dependent gem library installed they will get errors.

For example a client that does not have the rest-client gem installed will get the following error when they run cyclonedx-ruby:

kernel_require.rb:54:in `require': cannot load such file -- rest-client (LoadError)

How come you haven't cut a new gem in a while?

There last gem in rubygems.org is 1.1.0 - July 13, 2019 (8.5 KB). Also, I'm happy to help out with this project.

Cheers!