search

tern-tools / tern

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
BSD 2-Clause "Simplified" License
967 stars 188 forks source link

The support for C or C++ projects or containers #1178

Closed usmankhanisb closed 1 year ago

usmankhanisb commented 2 years ago

Please read the Code of Conduct before you proceed Code of Conduct

Ask your question here I am using couple of tools to generate SBOM but no success with C or C++ projects, can you please inform if C code is there or C compiled project is there that will you check all dependencies?

rnjudge commented 2 years ago

Hi @usmankhanisb. Is there a particular container base image you're inquiring about or are you asking about c/c++ binary blobs that are copied into a container?

usmankhanisb commented 2 years ago

The directory of project code probably, but even in containers if code is residing in file system than will it check C or C++

Regards, Usman Khan

From: Rose Judge @.> Sent: Wednesday, June 22, 2022 7:15:59 PM To: tern-tools/tern @.> Cc: usmankhanisb @.>; Mention @.> Subject: Re: [tern-tools/tern] The support for C or C++ projects or containers (Issue #1178)

Hi @usmankhanisbhttps://github.com/usmankhanisb. Is there a particular container base image you're inquiring about or are you asking about c/c++ binary blobs that are copied into a container?

— Reply to this email directly, view it on GitHubhttps://github.com/tern-tools/tern/issues/1178#issuecomment-1163401321, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AJNPR2VXFYGG2XTIE3FBBL3VQNC47ANCNFSM5ZQNH5BQ. You are receiving this because you were mentioned.Message ID: @.***>

rnjudge commented 2 years ago

Tern doesn't have the capability to inventory binary blobs. So if a C or C++ binary is copied intothe container then, no, it will not inventory it. If there's a C or C++ package installed by a package manager, Tern will attempt to inventory this.