Write an SBOM to disk

Serializes an <sbom> object as UTF-8 text with "\n" line endings and a trailing newline. Existing files are overwritten.

Usage

write_sbom(x, path, format = NULL, version = NULL)

Arguments

x

An <sbom> object from sbom_package() or sbom_installed().

path

A file path, or a directory when format = "all" (created if missing).

format

One of the format values in sbom_formats(), or "all". When NULL, the format is taken from the longest matching extension of path.

version

Specification version. It applies to every format being written whose versions (see sbom_formats()) include it; the others use their default, so format = "all" with version = "2.2" writes SPDX 2.2 and the default of each other format. It is an error when no format being written lists the version. NULL uses each format's default. CycloneDX 1.4 and 1.5 have no field for the organization that made the SBOM (their manufacture is the maker of the described component), so there it is written as the metadata property sbom:organization.

Value

path, invisibly.

Details

The formats, with the format value, file extension and versions (the default of each is in sbom_formats(): 1.6 for CycloneDX, 2.3 for SPDX 2.x):

format	Output	Extension	Versions
cyclonedx-json	CycloneDX JSON	.cdx.json	1.4, 1.5, 1.6, 1.7
cyclonedx-xml	CycloneDX XML	.cdx.xml	1.4, 1.5, 1.6, 1.7
spdx-json	SPDX JSON	.spdx.json	2.2, 2.3
spdx-yaml	SPDX YAML	.spdx.yaml	2.2, 2.3
spdx-xml	SPDX XML	.spdx.xml	2.2, 2.3
spdx-tv	SPDX tag-value	.spdx	2.2, 2.3
spdx3-jsonld	SPDX 3 JSON-LD	.spdx3.jsonld	3.0.1
swid	SWID tag	.swidtag	2015
csv	CSV inventory	.csv	none

format = "all" writes the eight standard formats, each at its default version unless version names one it lists, into the directory path. The files are named after the root component, as <name>-<version> followed by the extension, or <name> alone when the root has no version. The CSV inventory is not part of "all".

The SWID tag names the organization that made the SBOM by its registration id (regid). sbom_package() and sbom_installed() take it from their regid argument, whose default is the sbom.regid option; without one the tag uses the placeholder http://invalid.unavailable. The tag's tagId is the regid without its scheme or a trailing /, then a / and the root's reference, such as example.org/pkg:cran/dplyr@1.2.1 (the reference alone without a regid), and its tagVersion is the date of the timestamp as YYYYMMDD.

format = "csv" writes a component inventory for spreadsheet review. It is not an SBOM standard, is left out of format = "all", and takes no version. In every column, a value that starts with =, +, -, @, a tab or a carriage return gets a leading apostrophe, so a spreadsheet does not evaluate it as a formula. Real names, versions, dates and identifiers never start that way, so they are unchanged. The file starts with a UTF-8 byte-order mark so that spreadsheets read it as UTF-8; in R, read it with read.csv(path, fileEncoding = "UTF-8-BOM").

Examples

x <- sbom_package(system.file("DESCRIPTION", package = "sbom"), system = FALSE)
write_sbom(x, file.path(tempdir(), "sbom.cdx.json"))