search

fatihtokus / scan2html

A Trivy plugin that scans and outputs the results (vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more) to an interactive html file.
Apache License 2.0
28 stars 4 forks source link

Support for SBOM #36

Closed lucboj closed 2 months ago

lucboj commented 2 months ago

Hi,

I really like this plugin for Trivy as it fits perfectly in my project for visualizing Trivy reports.

I would like to ask if it could be possible to support SBOMs as well. Specifically in spdx format but cyclonedx would also be fine. The command would be something like: trivy scan2html image --format spdx ghcr.io/zalando/spilo-15:3.0-p1

fatihtokus commented 2 months ago

Hi @lucboj ,

It is great to get such a nice feedback from the community. We will be working on this feature. Stay tune.

Regards, Fatih

fatihtokus commented 2 months ago

Hi @lucboj ,

We have just released SBOM(spdx) feature, please have look and give us feedback 🥳 🎆 trivy scan2html image --format spdx ghcr.io/zalando/spilo-15:3.0-p1 interactive_result.html image

Regards, Fatih

lucboj commented 2 months ago

Hi @fatihtokus,

thank you very much! 🥳 Looks good! Will try to use it as soon as possible and give feedback! Great how fast it went 👍

Regards, Lucas

huornlmj commented 11 hours ago

Hi @fatihtokus @lucboj I tried the latest version on a Go.mod file system spdx format with scan2html but the "Supply chain SBOM" section came out empty despite it coming out with lots of BOM in command line output (without the scan2html plugin). Any thoughts or suggestions? I used the example in the front page readme: "trivy scan2html image --format spdx alpine:3.15 interactive_report.html" but substituted fs for image and the current dir "." instead of the image name.