jfrog / jfrog/jfrog-cli-security
Generate SBOM when scanning published builds using JF CLI
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Is your feature request related to a problem? Please describe.
A flag to generate an SBOM has recently been introduced in the jf audit and jf scan commands: https://github.com/jfrog/jfrog-cli-security/pull/307
Add the same functionality to the jf build-scan command.
Describe the solution you'd like to see
Add --sbom flag to build-scan command
Describe alternatives you've considered
Export the SBOM from the UI.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the existing SBOM handling in the jf audit and jf scan commands, using pull request 307 as the reference. Trace the jf build-scan command entry point and its argument handling, then add equivalent --sbom support and verify that published-build scans produce an SBOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100