61 lines
2.2 KiB
Bash
61 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# OWASP-Compliant Compact SBOM Generator (Ubuntu / Odoo)
|
|
# Standaard: CycloneDX 1.4 JSON via Trivy
|
|
# ==============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
# Pad-definities voor Cron compatibiliteit
|
|
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
|
export DEBIAN_FRONTEND="noninteractive"
|
|
|
|
# 1. Configuratie & Mappenstructuur
|
|
OUTPUT_DIR="/var/sbom_scans"
|
|
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
|
SCAN_DIR="${OUTPUT_DIR}/${TIMESTAMP}"
|
|
mkdir -p "${SCAN_DIR}"
|
|
|
|
FINAL_SBOM_JSON="${SCAN_DIR}/sbom_cyclonedx.json"
|
|
ODOO_CONF="/etc/odoo-server.conf"
|
|
|
|
echo "[+] OWASP SBOM Generator gestart op $(hostname)..."
|
|
|
|
# 2. Afhankelijkheden controleren (Trivy + jq)
|
|
if ! command -v jq &> /dev/null; then
|
|
apt-get update -qq && apt-get install -y -qq jq
|
|
fi
|
|
|
|
if ! command -v trivy &> /dev/null; then
|
|
echo "[+] Trivy installeren..."
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
fi
|
|
|
|
# 3. Genereer gerichte CycloneDX SBOM
|
|
echo "[+] Scannen van Python omgeving, Odoo en OS pakketten..."
|
|
|
|
trivy fs / \
|
|
--pkg-types os,library \
|
|
--skip-dirs "/proc,/sys,/dev,/run,/tmp,/var/lib/docker,/var/log,/usr/share" \
|
|
--format cyclonedx \
|
|
--output "${FINAL_SBOM_JSON}" \
|
|
--quiet || true
|
|
|
|
# 4. Resultaat verifiëren en samenvatting tonen
|
|
if [ -s "${FINAL_SBOM_JSON}" ]; then
|
|
TOTAL_COMPONENTS=$(jq '.components | length' "${FINAL_SBOM_JSON}" 2>/dev/null || echo "0")
|
|
|
|
echo "=============================================================================="
|
|
echo " [V] OWASP CycloneDX SBOM Succesvol Gegenereerd!"
|
|
echo " Locatie: ${FINAL_SBOM_JSON}"
|
|
echo " Componenten: ${TOTAL_COMPONENTS} (Compact & Overzichtelijk)"
|
|
echo "=============================================================================="
|
|
|
|
echo ""
|
|
echo "Snel overzicht van de eerste 5 gedetecteerde componenten:"
|
|
jq -r '.components[0:5][] | " - \(.name) (\(.version // "bekende versie")) [\(.type)]"' "${FINAL_SBOM_JSON}" 2>/dev/null || true
|
|
echo ""
|
|
else
|
|
echo "[X] Fout: Er is geen inhoud gegenereerd in het SBOM-bestand."
|
|
exit 1
|
|
fi |