We are happy to announce that AppThreat #cdxgen, a polyglot CycloneDX #SBOM generation tool created by Prabhu Subramanian, is now officially an #OWASP CycloneDX project. Mr. Subramanian continues to lead this project with the backing of the wider OWASP community.

cdxgen aims to simplify the SBOM generation workflow for various languages, package managers, containers, and even operating systems with a single command, often requiring no additional arguments.

The tool is available under an #opensource license as an npm package (@CycloneDX/cdxgen) and a container image (docker pull ghcr.io/cyclonedx/cdxgen) for effortless integration into CI/CD environments and other application security tools.

Welcome aboard Prabhu. We’re honored to have you as one of our outstanding maintainers.

https://github.com/CycloneDX/cdxgen

You can find cdxgen and over 180 other tools that support CycloneDX, at https://cyclonedx.org/tool-center/

@karabaic @suchakra How about using #cdxgen to submit your list of OS software in @CycloneDX instead of running an agent?

@suchakra Those queries aren't even comprehensive. #cdxgen has a much better list for SBoM generation https://github.com/AppThreat/cdxgen/blob/master/queries.json

Should #cdxgen support automatic #SBoM submission to @github via the dependency submission API? It's a bit of work since they've reinvented another SBoM spec instead of reusing CycloneDX or SPDX, but happy to spend time if there is interest. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api

#SBoM #cdxgen https://github.com/AppThreat/cdxgen#plugins
npm install -g @appthreat/cdxgen
npm install -g @ngcloudsec/cdxgen-plugins-bin
cdxgen -t os

Have you ever wondered if there was a tool that could generate a
@CycloneDX_Spec
#SBoM for a live system or a VM for compliance or auditing? #cdxgen 5.1.0 is now available with os scan support.

Early Black Friday deal: #cdxgen (#CycloneDX Generator) 5.0.1 is out now with #SBoM support for:
✅ docker/OCI images with OS packages (Powered by #Trivy)
✅ Rust binary (Powered by Cargo Auditable)

https://github.com/AppThreat/cdxgen