Written by Jamie Tanna
on 
CC-BY-NC-SA-4.0 Apache-2.0
2 mins

Introducing snyk-export-sbom to export SPDX and CycloneDX SBOM from Snyk

Featured image for sharing metadata for article

I've written about Software Bill of Materials (SBOMs) a fair bit recently and how they can be used to get more insight into your project's dependencies

As part of starting to use Snyk at work, I've been looking at how to integrate Snyk's data alongside dependency-management-data, using the SBOM import functionality in dependency-management-data.

Snyk has had support for exporting a project's SBOM, which does most of the work 👏 However, one thing that snyk-export-sbom does on top of the existing offering is that it gives us the ability to add licensing information to the generated SBOMs.

This is currently available on the legacy API so we can take this data and interweave it with the SBOM that Snyk produces. I've raised a feature request to get licensing data added to the new APIs, or even automagically inserted into the SBOMs Snyk produces, but until then, we've at least got this functionality in my tool.

You can find the project on GitLab.com, which can be installed with:

go install gitlab.com/tanna.dev/snyk-sbom-export@latest

Then you can run it like so:

env SNYK_API_TOKEN=... snyk-sbom-export -orgID ... -format cyclonedx1.4+json

This will then iterate through each of the projects in your organisation, generating an SBOM and adding any licensing information it knows about your dependencies.

Something I didn't realise until after I've built it is that SBOM export is only available for Open Source projects, which is a bit disappointing 😅 I'm considering writing export functionality myself using the legacy APIs to make it possible to get SBOMs from the data that Snyk collects on your projects.

Update: this appears to affect Docker-based SBOM exports, not other ecosystems, at least for the few I've tried.

Written by Jamie Tanna's profile image Jamie Tanna on , and last updated on .

Content for this article is shared under the terms of the Creative Commons Attribution Non Commercial Share Alike 4.0 International, and code is shared under the Apache License 2.0.

#sbom #snyk.

This post was filed under articles.

Interactions with this post

Interactions with this post

Below you can find the interactions that this page has had using WebMention.

Have you written a response to this post? Let me know the URL:

Do you not have a website set up with WebMention capabilities? You can use Comment Parade.