diff --git a/scripts/sbom/README.md b/scripts/sbom/README.md index 627b2ffa..3b4e2de5 100644 --- a/scripts/sbom/README.md +++ b/scripts/sbom/README.md @@ -8,7 +8,7 @@ Install the Syft binary. Use the following command to generate a simple SBOM file form the repository: -```SH +```shell syft . ``` @@ -16,8 +16,8 @@ Alternative output variants can be found [here](https://github.com/anchore/syft/ Use the following command to generate a SBOM markdown file using the `example.sbom.tmpl` goTemplate template file: -```SH -SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t syft.sbom.tmpl +```shell +SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl ``` Setting the env variable `SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true` will ensure to lookup licenses remotely. In this example the sparrow image in version `v0.5.0` is scanned. diff --git a/scripts/sbom/example.sbom.tmpl b/scripts/sbom/example.sbom.tmpl index b6727b22..7e132a1f 100644 --- a/scripts/sbom/example.sbom.tmpl +++ b/scripts/sbom/example.sbom.tmpl @@ -1,5 +1,5 @@ | Package | Type | Version | Licenses | | ------- | ---- | ------- | -------- | {{- range .artifacts}} -| {{.name}} | {{.type}} | {{.version}} | {{range .licenses}}{{.value}}, {{end}} | +| {{.name}} | {{.type}} | {{.version}} | {{range $index, $licence := .licenses}}{{- if $index}}, {{end}}{{$licence.value}}{{end}} | {{- end}} \ No newline at end of file