CycloneDX / CycloneDX/tool-center

Add SBOMlyze to the Tool Center

Open Beginner friendly
#138 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
20
Forks
73
Avg merge
18h 46m
Merged PRs (30d)
16

Description

# Tool Center submission: SBOMlyze

Please add SBOMlyze to the CycloneDX Tool Center.

SBOMlyze is an open-source CLI and GitHub Action that consumes CycloneDX SBOMs,
compares them with a trusted baseline, detects same-version hash/integrity drift
and other semantic changes, evaluates policy, and can convert between
CycloneDX, SPDX, and Syft formats.

The proposed `tools/sbomlyze.json` entry below validates against the current
`schemas/tool.schema.json` on the `main` branch.

```json
{
"$schema": "https://cyclonedx.org/schema/tool-center-v2.tool.schema.json",
"specVersion": "2.0",
"tool": {
"name": "SBOMlyze",
"publisher": "rezmoss",
"description": "Open-source CLI and GitHub Action that compares CycloneDX, SPDX, and Syft SBOMs; detects same-version hash drift, dependency-graph, license, and compliance regressions; and gates pull requests with policy and SARIF.",
"repository_url": "https://github.com/rezmoss/sbomlyze",
"website_url": "https://rezmoss.github.io/sbomlyze/",
"capabilities": [
"SBOM"
],
"availability": [
"OPEN_SOURCE",
"OSI_APPROVED"
],
"functions": [
"ANALYSIS",
"TRANSFORM"
],
"analysis": [
"LICENSE_REPORTING",
"POLICY_EVALUATION"
],
"transform": [
"BOM_SERIALIZATION_FORMAT",
"BOM_STANDARD"
],
"packaging": [
"APPLICATION",
"COMMAND_LINE_UTILITY",
"GITHUB_ACTION"
],
"platform": [
"LINUX",
"MAC",
"WINDOWS"
],
"lifecycle": [
"BUILD",
"POST-BUILD"
],
"supportedStandards": [
"CPE",
"CYCLONEDX",
"PACKAGE_URL",
"SPDX"
],
"cycloneDxVersion": [
"CYCLONEDX_V1.6",
"CYCLONEDX_V1.5",
"CYCLONEDX_V1.4"
]
}
}
```

Evidence:

- Repository: https://github.com/rezmoss/sbomlyze
- CycloneDX demonstration: https://github.com/rezmoss/sbomlyze-node-cyclonedx-demo
- GitHub Marketplace Action: https://github.com/marketplace/actions/sbomlyze-diff
- License: Apache-2.0

Contributor guide

Open the contributing guide

Research direction

Start with the supplied tools/sbomlyze.json entry and validate it against schemas/tool.schema.json on the main branch. Done means the SBOMlyze metadata is accepted by the current schema and appears in the CycloneDX Tool Center.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.