{"id":3146,"date":"2022-01-22T12:14:38","date_gmt":"2022-01-22T10:14:38","guid":{"rendered":"https:\/\/ofcourseimright.com\/?p=3146"},"modified":"2022-04-04T07:43:02","modified_gmt":"2022-04-04T05:43:02","slug":"creating-standard-inventories-for-ubuntu-systems","status":"publish","type":"post","link":"https:\/\/ofcourseimright.com\/?p=3146","title":{"rendered":"Creating standard inventories for Ubuntu systems"},"content":{"rendered":"\n
\"Subject<\/a><\/figure><\/div>\n\n\n\n

As I’ve previously mentioned on this blog, software bills of materials (SBOMs) are software ingredient lists similar to what you would find on a can of soup. The purpose of these lists is to determine if something bad is in the mix, so that administrators can figure out where their risks are. This is why President Biden\u2019s Executive Order<\/a> from last May specifically called them out. <\/p>\n\n\n\n

Here now is a tool that I’ve just posted to pypi called apt2sbom. This tool is specific to Ubuntu<\/a>. Similar tools can be built for other distributions. This tool will take the already existing information on a Ubuntu system and collect it into one of the standard formats, such as SPDX<\/a> or CycloneDX<\/a>.<\/p>\n\n\n\n

% pip3 install apt2sbom\n[...]\n% apt2sbom -h\n\nusage: apt2sbom [-h] (-j | -y | -c) [-p]\n\ngenerate SPDX file from APT inventory\n\noptional arguments:\n  -h, --help       show this help message and exit\n  -j, --json       Generate JSON SPDX output\n  -y, --yaml       Generate YAML SPDX output\n  -c, --cyclonedx  Generate CycloneDX JSON output\n  -p, --pip        Include PIP files\n<\/pre>\n\n\n\n
The resulting file is then suitable for import into tooling that can spot vulnerabilities in particular versions of software.<\/p>\n\n\n\n
The package is a little on the early side.  There might still be a few bugs here or there.  If you find one, just post it to the source repository as an issue<\/a>.<\/p>\n\n\n\n
Would this be considered a complete SBOM?  Probably not, because there may be software installed on a system that is not part of either the apt or python distributions.  However, it\u2019s fairly easy to add additional elements into these files, particular the JSON ones.<\/p>\n","protected":false},"excerpt":{"rendered":"
Here’s a tool to create standard SBOMs from Ubuntu distribution information.<\/p>\n","protected":false},"author":172,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[545,9],"tags":[362,606,605,496],"class_list":["post-3146","post","type-post","status-publish","format-standard","hentry","category-iot","category-security","tag-cybersecurity","tag-ingredients","tag-sbom","tag-security"],"_links":{"self":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/3146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/users\/172"}],"replies":[{"embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3146"}],"version-history":[{"count":4,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/3146\/revisions"}],"predecessor-version":[{"id":3202,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=\/wp\/v2\/posts\/3146\/revisions\/3202"}],"wp:attachment":[{"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ofcourseimright.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}