4장: SBOM 생성과 관리

{
  "spdxVersion": "SPDX-3.0",
  "dataLicense": "CC0-1.0",
  "name": "myapp-sbom",
  "documentNamespace": "https://example.com/myapp-v1.0",
  "packages": [
    {
      "name": "express",
      "SPDXID": "SPDXRef-Package-express",
      "versionInfo": "4.18.2",
      "downloadLocation": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
      "licenseConcluded": "MIT",
      "supplier": "Organization: OpenJS Foundation",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/express@4.18.2"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relationshipType": "DESCRIBES",
      "relatedSpdxElement": "SPDXRef-Package-express"
    }
  ]
}

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "myapp",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "abc123..."
        }
      ]
    }
  ]
}

# 설치
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
 
# 컨테이너 이미지에서 SBOM 생성 (SPDX JSON)
syft myapp:latest -o spdx-json > sbom-spdx.json
 
# CycloneDX JSON 형식
syft myapp:latest -o cyclonedx-json > sbom-cdx.json
 
# 파일시스템에서 SBOM 생성
syft dir:./src -o cyclonedx-json > sbom-src.json
 
# 특정 형식으로 여러 출력 동시 생성
syft myapp:latest \
  -o spdx-json=sbom-spdx.json \
  -o cyclonedx-json=sbom-cdx.json \
  -o table

# CycloneDX 형식으로 SBOM 생성
trivy image --format cyclonedx --output sbom.json myapp:latest
 
# SPDX JSON 형식
trivy image --format spdx-json --output sbom-spdx.json myapp:latest
 
# 생성된 SBOM으로 취약점 스캔
trivy sbom sbom.json

# Cosign으로 SBOM을 이미지에 첨부
cosign attach sbom --sbom sbom-cdx.json registry.example.com/myapp:v1.0
 
# ORAS로 아티팩트 푸시 (OCI 1.1 Referrers API)
oras attach registry.example.com/myapp:v1.0 \
  --artifact-type application/vnd.cyclonedx+json \
  sbom-cdx.json

name: SBOM Generation
 
on:
  push:
    branches: [main]
 
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
 
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          image: myapp:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.json
 
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom-${{ github.sha }}
          path: sbom.json
          retention-days: 90
 
      - name: Scan SBOM for vulnerabilities
        run: trivy sbom sbom.json --severity HIGH,CRITICAL --exit-code 1

# jq로 CycloneDX SBOM에서 특정 패키지 검색
cat sbom-cdx.json | jq '.components[] | select(.name == "openssl")'
 
# Grype로 특정 CVE 영향 확인
grype sbom:sbom.json --only-fixed | grep CVE-2024-12345

# 라이선스 스캔
trivy image --scanners license myapp:latest
 
# 특정 라이선스 카테고리 차단
trivy image --scanners license \
  --severity HIGH \
  --exit-code 1 \
  myapp:latest