Generate an SBOM for each release

​

Goal

• CycloneDX 1.7, with components, licences, evidence, and known vulnerabilities
• SPDX 2.3, with components and licences

​

When to use it

• A customer, a regulation, or your own policy asks for an SBOM with each release.
• You want a single record of what a release contained, stored next to the release.

​

Prerequisites

• scanoss-cli, jq, and SCANOSS_API_KEY (see Recipes)
• The source tree checked out at the release tag
• Optional: a scanoss.json with your approvals, so the SBOM marks approved components

​

The script

#!/usr/bin/env bash
# Produce the SBOMs for one release.
# Usage: ci/scanoss-release-sbom.sh <version>   e.g. ci/scanoss-release-sbom.sh 2.4.0
set -euo pipefail

VERSION="${1:?usage: $0 <version>}"
OUT="sbom"
mkdir -p "$OUT"

inventory="${OUT}/inventory-${VERSION}.json"
cyclonedx="${OUT}/sbom-${VERSION}.cdx.json"
spdx="${OUT}/sbom-${VERSION}.spdx.json"

# 1. One scan, with the declared dependencies, licences, and vulnerabilities.
scanoss-cli scan . \
  --include deps,licenses,vulns \
  --output "$inventory"

# 2. Convert offline: no second scan, no API calls.
scanoss-cli sbom "$inventory" --format cyclonedx --output "$cyclonedx"
scanoss-cli sbom "$inventory" --format spdx      --output "$spdx"

# 3. Sanity checks before publishing.
jq -e '.bomFormat == "CycloneDX"' "$cyclonedx" > /dev/null
jq -e '.spdxVersion | startswith("SPDX-2.")' "$spdx" > /dev/null

# 4. Checksums, so consumers can verify the files.
( cd "$OUT" && sha256sum "$(basename "$inventory")" "$(basename "$cyclonedx")" "$(basename "$spdx")" > "SHA256SUMS-${VERSION}" )

jq -r '"Components: \(.components | length)   Vulnerabilities: \(.vulnerabilities // [] | length)"' "$inventory"

​

What each step does

1. Scan once. scan . fingerprints the release, matches it against the SCANOSS Knowledge Base, and writes the raw inventory. --include adds three layers:
   • deps: dependencies declared in manifest files such as package.json or go.mod, resolved through the API. They appear with "scope": "declared".
   • licenses: the licences of every component, detected or declared.
   • vulns: known vulnerabilities for every component.
2. Convert. scanoss-cli sbom reads the inventory and writes the requested format. It does not contact the API, so it is fast and gives the same result each time. --format is required.
3. Check. jq -e exits non-zero if a file is not the expected format, so the job stops before it publishes a broken SBOM.
4. Checksums. A SHA256SUMS file lets consumers confirm they have the files you published.

​

What the output means

​

How it fails the pipeline

ci/scanoss-policy.sh "sbom/inventory-${VERSION}.json"

​

Variations

• One format only. Skip the raw inventory and scan straight into a format: scanoss-cli scan . --include deps,licenses,vulns --format cyclonedx --output sbom.cdx.json. You lose the raw inventory, but you can still refresh the CycloneDX file later.
• Convert an SBOM you already have. scanoss-cli sbom also converts between CycloneDX and SPDX: scanoss-cli sbom bom.cdx.json --format spdx --output bom.spdx.json.
• Run in a container. See Using Docker.