SBOM generator

2026-09-15 08:21:25 +00:00
commit c8ec2ed6b4
1 changed files with 59 additions and 0 deletions
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# OWASP-Compliant Compact SBOM Generator (Ubuntu / Odoo)
+# Standaard: CycloneDX 1.4 JSON via Trivy
+# ==============================================================================
+
+set -euo pipefail
+
+# 1. Configuratie & Mappenstructuur
+OUTPUT_DIR="/var/sbom_scans"
+TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+SCAN_DIR="${OUTPUT_DIR}/${TIMESTAMP}"
+mkdir -p "${SCAN_DIR}"
+
+FINAL_SBOM_JSON="${SCAN_DIR}/sbom_cyclonedx.json"
+ODOO_CONF="/etc/odoo-server.conf"
+
+echo "[+] OWASP SBOM Generator gestart op $(hostname)..."
+
+# 2. Afhankelijkheden controleren (Trivy + jq)
+if ! command -v jq &> /dev/null; then
+    apt-get update -qq && apt-get install -y -qq jq
+fi
+
+if ! command -v trivy &> /dev/null; then
+    echo "[+] Trivy installeren..."
+    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+fi
+
+# 3. Genereer gerichte CycloneDX SBOM
+# Volgens OWASP: Alleen relevante runtime packages (Python/Pip + DPKG)
+echo "[+] Scannen van Python omgeving, Odoo en OS pakketten..."
+
+trivy fs / \
+    --pkg-types os,library \
+    --skip-dirs "/proc,/sys,/dev,/run,/tmp,/var/lib/docker,/var/log,/usr/share" \
+    --format cyclonedx \
+    --output "${FINAL_SBOM_JSON}" \
+    --quiet || true
+
+# 4. Resultaat verifiëren en samenvatting tonen
+if [ -s "${FINAL_SBOM_JSON}" ]; then
+    TOTAL_COMPONENTS=$(jq '.components | length' "${FINAL_SBOM_JSON}" 2>/dev/null || echo "0")
+    
+    echo "=============================================================================="
+    echo " [V] OWASP CycloneDX SBOM Succesvol Gegenereerd!"
+    echo " Locatie:    ${FINAL_SBOM_JSON}"
+    echo " Componenten: ${TOTAL_COMPONENTS} (Compact & Overzichtelijk)"
+    echo "=============================================================================="
+    
+    # Snel inzicht in de top componenten via CLI zonder de JSON te hoeven openen
+    echo ""
+    echo "Snel overzicht van de eerste 5 gedetecteerde componenten:"
+    jq -r '.components[0:5][] | " - \(.name) (\(.version // "bekende versie")) [\(.type)]"' "${FINAL_SBOM_JSON}" 2>/dev/null || true
+    echo ""
+else
+    echo "[X] Fout: Er is geen inhoud gegenereerd in het SBOM-bestand."
+    exit 1
+fi