Starburst Enterprise SBOM

sbom.sh

#!/usr/bin/env bash

set -euo pipefail

usage() {
    cat <<EOF 1>&2
Usage: $0 [-h] -n <NAME>
Generates a Software Bill of Materials (SBOM) for the SEP Docker image

-h       Display help
-n       Image name to use
EOF
}

IMAGE=

while getopts ":h:n:" o; do
    case "${o}" in
        n)
            IMAGE=${OPTARG}
            ;;
        h)
            usage
            exit 0
            ;;
        *)
            usage
            exit 1
            ;;
    esac
done
shift $((OPTIND - 1))

# Retrieve the script directory.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
cd "${SCRIPT_DIR}" || exit 2

if [ -z "$IMAGE" ]; then
    echo >&2 "Image name (-n) is required"
    exit 1
fi

DIR=$(mktemp -d)
cd "$DIR" || exit 2

docker save "$IMAGE" -o image.tar
tar xf image.tar
for a in */; do
    cd "$a"
    tar xf layer.tar
    cd -
done

unzip ./*/usr/lib/starburst/lib/starburst-server-main-*.jar 'webapp/*'

cd -

syft packages dir:"$DIR" -o "cyclonedx-json=sbom.cdx.json"

find "$DIR" -type d -exec chmod 775 {} \;
rm -rf "$DIR"