Output multiple SBOM formats

[idunbarh]

Description

We're creating several SBOM Generation Reference Implementations as part of the CISA SBOM Community.

• https://github.com/CISA-SBOM-Community/SBOM-Generation

We're encouraging open source projects to create both SPDX and CDX formats. My understanding today is that trivy can only create a single SBOM at a time. This results in needing to call trivy multiple times to generate both CDX and SPDX sboms.

Ideally there could be a way to specify multiple --format and --output options, to support creation of multiple SBOM documents in different formats.

Target

SBOM

Scanner

None

[knqyf263]

After discussion, we concluded that multiple --format and --output is not straightforward in Trivy. Instead, we implemented trivy convert. Does it work for you?

[idunbarh]

Unfortunately it does not meet our need.

Not for technical reasons through. We want to equally represent both SPDX and CycloneDX SBOMs in the our reference examples. Generating in one format and then converting to another will elevate one format politically.

I appreciate the response, we'll continue to call generate twice.

[fatihtokus]

I guess to solve the 'political' problem you can generate JSON then convert to two formats :)

[itaysk]

in addition to the provided answer, one could create an output plugin that emit both sboms

[knqyf263]

As @fatihtokus said, the document I shared shows how to generate Trivy JSON and convert it into two formats.

$ trivy image --format json -o result.json --list-all-pkgs debian:11
$ trivy convert --format cyclonedx --output result.cdx result.json
$ trivy convert --format spdx --output result.spdx result.json

Also, as @itaysk said, you can create a small shell script plugin with the above commands. (cf. trivy-plugin-kubectl)