🛠Security SBOM generator with vulnerability chechup

Salute,

Today I want to share a tula that I twirled on the yoke. This tool helps you quickly and in a more convenient form collect SBOM for a project; this will be especially useful for certification according to FSTEC of Russia, including monitoring your supply-chain.

Tula is built in such a way that you don’t have to fumble around with dependencies, but get a normal, structured picture of the software’s composition. that is, a clear map of components, versions and metadata, which further helps with auditing, supply chain risks and checking vulnerabilities for each component.

It is this approach that fits well in practices where the SBOM is generated automatically from a repository or assembly artifact, and then used further in pipelines and control systems.

How does it work?

• Generates a project SBOM in one of the standard formats so that it can be further transferred to other tools or stored as an artifact

• Helps bring the result into a more convenient form, so that the SBOM is not just a “damp sheet”, but is readable

• Suitable for automation in CI/CD, as a permanent part of the supply-chain process

• Can be used as a starting point for further analysis of dependencies, licenses and vulnerabilities

• Can be used for certification in FSTEC of Russia according to the requirements of the testing laboratory, including

• Works well in scenarios where you need to quickly export dependencies and then run them through security tools or load them into an external loop

Functionally

• Generates SBOM from a local directory or Git repository (GitHub / GitLab)

• Scans vulnerabilities via Trivy, OWASP Dependency-Check, Clair

• Embeds detected vulnerabilities into SBOM (CycloneDX 1.5)

• Exports readable reports: Excel (.xlsx), Word (.docx), ODT (.odt)

• Signs the resulting SBOM (SHA-256)

Why?

• Before release, to understand what it consists of and what dependencies are used

• In CI/CD, so that the SBOM is automatically generated for each build or release and it is possible to check workarounds from commands for used dependencies

• For security review, when you need to quickly show the composition of dependencies and risk points

• For compliance and supply-chain control

I plan to tighten it up

• More flexible generation modes for different types of projects

• Make post-processing and result validation more convenient

Links

• PyPi

• DockerHub

• Github Package

Structure

sbom_genform/

├── src/sbom_pipeline/

│ ├── cli.py #secsbom/secsbom-pipeline (typer)

│ ├── pipeline.py # orchestrator

│ ├── generate.py # SBOM generation

│ ├── dedup.py # deduplication

│ ├── sign.py # SHA-256 signature

│ ├── exporter.py #xlsx/docx/odt

│ ├── vuln_merger.py # embedding vulnerabilities

│ ├── config.py # configuration

│ └── scanner/

│ ├��─ trivy.py

│ ├── depcheck.py

│ └──clair.py

├──docker/

│ └── Dockerfile.secgensbom

├── examples/project_inject/ # vulnerable PHP

├── secgensbom/secgensbom.yml # GitLab CI shared template

├── .github/workflows/

│ ├── ci.yml

│ ├── secgensbom.yml

│ └── publish.yml

├── tests/test_smoke.py

├── pyproject.toml

└── .env.example

#appsec #devsecops #specialty #toolchain #techsolution #paper #sbom