SPDX SBOM generation

[stevemagness]

With the announcement that SPDX is now an ISO standard (https://spdx.dev/spdx-specification-is-now-an-iso-standard/), would the remit of renovatebot extend to generating an SPDX SBOM? Feels like it might be 'half way there' already because it knows about the dependencies?

[rarkins]

I think "half way there" is probably accurate. Renovate currently doesn't care enough about transitive dependencies - because it only cares about things it can update. It may not fit well into the CLI approach either, but it's something I'd consider adding as an export from the app dashboard.

[Silvanoc]

The Renovate scanning capabilities are amazing even if only for direct dependencies. IMO only that functionality might be very useful to get direct dependencies that can be used as an input for other tools capable of creating dependency trees including transitive dependencies.

Is there a way to let Renovate generate a machine-friendly dependency list (for example, in a JSON document) without getting the MRs?

[Silvanoc]

BTW I'm not thinking on a CLI approach, but rather a pipeline approach. For example, a pipeline that can create SBOMs for release tags.

[HonkingGoose]

Self-service SBOM

You can generate a NTIA-compliant SBOM from any GitHub-hosted repository where you have read access. Read the GitHub blog for more information, two relevant quotes to get you started:

Today, we’re happy to announce a new Export SBOM function that allows anyone with read access to a GitHub cloud repository to generate an NTIA-compliant SBOM with a single click. ¹

To generate an SBOM, simply click the new Export SBOM button on a repository’s dependency graph.

Third-party actions to generate SBOM

For example, a pipeline that can create SBOMs for release tags.

The GitHub docs mention some third-party actions that can generate a SBOM for you ². GitHub recommends the sbom-generator-action. ³

Footnotes

1. GitHub Blog, Introducing self-service SBOMs ↩

2. GitHub Docs, Generating and submitting a SBOM ↩

3. GitHub Marketplace, SBOM-generator-action ↩

[setchy]

+1 - would really love to be able to generate SPDX SBOMs from my renovate pipeline (currently using the CLI + Bitbucket Pipelines)

[jamietanna]

FYI I've built a tool for this (more info) that takes ie Renovate's debug logs and will then produce an SBOM - as above it'll only depend on the data that Renovate exposes, but can be a good start