This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Tools

1: FOSSology

2: SW360

3: FOSSLight

4: OSV-SCALIBR

This section introduces open source tools needed for open source management and explains how to use them.

Author : Haksung Jang / CC BY 4.0

1 - FOSSology

For open source compliance, you can use a source code scanning tool to detect the open source and license information contained within software.

< https://www.fossology.org/ >

The Linux Foundation’s FOSSology project developed this scanning tool and released it as open source so that anyone can use it freely.

Key Features

FOSSology is a web-based program that lets users log in to the website and upload individual files or software packages. FOSSology detects license text and copyright information within the uploaded files. Developers should use FOSSology when they want to check what license a piece of open source carries and what its copyright information looks like. FOSSology scans every file in an uploaded open source package, automatically detects license-related text and copyright information in each file, and generates a report from it. For more details on FOSSology’s key features, refer to the following page. : https://www.fossology.org/features/

Installation

To use FOSSology within a company, you need to build a FOSSology server in-house. This requires installing FOSSology on a Linux-based server system. FOSSology can be installed in the following three ways.

Using Docker
Using Vagrant and VirtualBox
Installing via a source build

This section explains the simplest method, using Docker.

FOSSology publishes a containerized Docker image through Docker Hub (https://hub.docker.com/). : https://hub.docker.com/r/fossology/fossology

The pre-built Docker image can be run using the following command.

$ docker run -p 8081:80 fossology/fossology

The Docker image can be accessed with the following URL and account information. : http://[IP_OF_DOCKER_HOST]:8081/repo

Username : fossy
Passwd : fossy

For more details on installation, refer to the following page. : https://github.com/fossology/fossology/blob/master/README.md

Test Server

If it is difficult to build a system on which to install FOSSology, you can use the test server provided by the FOSSology Project. The FOSSology project provides an environment for testing. (The test server may go down without notice.)

Users can access the FOSSology test server with the following account to try out FOSSology’s features.

Test server URL: [https://fossology.osuosl.org/](https://fossology.osuosl.org/) * Username: fossy * Password: fossy

Basic Workflow

The basic usage procedure for FOSSology is as follows.

To check the license and copyright information of the open source you want to use, compress its source code into a single file and upload it to FOSSology.
To do this, select Menu > Upload > From File.

Select the file to upload and click the Upload button.
Once the upload completes, the Job Agent automatically performs the analysis.
You can check the Status of the analysis in progress at Menu > Jobs > My Recent Jobs.

Once the analysis completes, you can check the results at Menu > Browse.

Selecting an individual file lets you see what license-related text FOSSology has detected.

At Menu > Browser > select a file or directory > Copyright/Email/Url/Author, you can see the Copyright/Email/Url/Author information FOSSology detected.

After checking whether these analysis results are valid, users can exclude incorrectly detected items from the analysis results. FOSSology describes this as the Clearing process; for more details, refer to the following page. : https://www.fossology.org/get-started/basic-workflow/

Using the method above, you can easily check what license the open source you want to use carries and what its copyright information is.

2 - SW360

(Updated on August 29, 2023.)

A company that develops and distributes products containing open source needs to collect and track information such as the version and license of the open source used, for each product and release version. This allows the company to carry out proper open source compliance activities.

In particular, when a security vulnerability is reported for a specific open source version at NVD (https://nvd.nist.gov/vuln), a company that cannot trace which products use that version ends up unable to determine which products need the security patch applied, leaving its products exposed to the vulnerability.

This makes tracking open source information a necessity. Companies address this either by building their own system or by purchasing and using a commercial service. SW360 is open source software sponsored by the Eclipse Foundation, providing a web application and repository for collecting and tracking software Bill of Materials (BOM) information.

< https://www.eclipse.org/sw360/ >

Key Features

SW360 provides a web-based UI, and its key functions are as follows.

Tracking components used in a product
Security vulnerability assessment
License obligation management
Generating legal documents such as notices

Installation

SW360 is composed as follows.

Frontend : Liferay-(Tomcat-)based portal application
Backend : Tomcat-based thrift service
Database : CouchDB

For details on the project structure and the software required for installation, see the Required software section of the README. : https://github.com/eclipse-sw360/sw360

SW360 offers the following installation methods. Users can choose one of them for installation.

Can be deployed via Docker. : https://github.com/eclipse-sw360/sw360/blob/main/README_DOCKER.md
Can install SW360’s components individually. : https://github.com/eclipse/sw360
Vagrant-based (https://www.vagrantup.com/) installation: Vagrant is a tool for managing virtualized instances, and sw360vagrant provides an environment for deploying SW360 all at once. : https://github.com/sw360/sw360vagrant
- The Vagrant-based installation guide can be found here. (Note: because the code has changed since the guide was written, it may not work correctly.)

This guide introduces the method of deploying with Docker. For details, refer to the README. : https://github.com/eclipse-sw360/sw360/blob/main/README_DOCKER.md

1. Download the Code

Download the code to build the Docker image. The tested code can be obtained here. : https://github.com/haksungjang/sw360/tree/docker_build

git clone -b docker_build https://github.com/haksungjang/sw360.git

2. Build

First, install Docker. (Note that a paid purchase may be required for corporate developer use.)

Build by running docker_build.sh as shown below.

cd sw360
./docker_build.sh

Once the build completes successfully, you can check the created images as shown below.

docker image ls

REPOSITORY                       TAG              IMAGE ID       CREATED          SIZE
eclipse-sw360/sw360              18-development   ab0fd848bf80   8 minutes ago    2.95GB
eclipse-sw360/sw360              latest           ab0fd848bf80   8 minutes ago    2.95GB
ghcr.io/eclipse-sw360/sw360      18-development   ab0fd848bf80   8 minutes ago    2.95GB
ghcr.io/eclipse-sw360/sw360      latest           ab0fd848bf80   8 minutes ago    2.95GB
eclipse-sw360/binaries           18-development   aa7debf0a1fc   8 minutes ago    347MB
eclipse-sw360/binaries           latest           aa7debf0a1fc   8 minutes ago    347MB
ghcr.io/eclipse-sw360/binaries   18-development   aa7debf0a1fc   8 minutes ago    347MB
ghcr.io/eclipse-sw360/binaries   latest           aa7debf0a1fc   8 minutes ago    347MB
eclipse-sw360/base               18-development   e5147733fc88   37 minutes ago   1.52GB
eclipse-sw360/base               latest           e5147733fc88   37 minutes ago   1.52GB
ghcr.io/eclipse-sw360/base       18-development   e5147733fc88   37 minutes ago   1.52GB
ghcr.io/eclipse-sw360/base       latest           e5147733fc88   37 minutes ago   1.52GB
ghcr.io/eclipse-sw360/thrift     0.18.1           0012d7998058   4 weeks ago      152MB
ghcr.io/eclipse-sw360/thrift     latest           0012d7998058   4 weeks ago      152MB
eclipse-sw360/thrift             0.18.1           0012d7998058   4 weeks ago      152MB
eclipse-sw360/thrift             latest           0012d7998058   4 weeks ago      152MB

3. Run

Run the created images with the docker-compose up command.

docker-compose up

Once it runs successfully, you can see three containers running as shown below.

docker ps 

CONTAINER ID   IMAGE                 COMMAND                  CREATED         STATUS                   PORTS                                              NAMES
4299fd39010c   eclipse-sw360/sw360   "/app/entry_point.sh"    3 minutes ago   Up 3 minutes             0.0.0.0:8080->8080/tcp, 0.0.0.0:11311->11311/tcp   sw360
13fd5696b140   postgres:14           "docker-entrypoint.s…"   3 minutes ago   Up 3 minutes (healthy)   0.0.0.0:5438->5432/tcp                             sw360-postgresdb-1
7bb70f2daaf4   couchdb               "tini -- /docker-ent…"   3 minutes ago   Up 3 minutes (healthy)   4369/tcp, 9100/tcp, 0.0.0.0:5984->5984/tcp         sw360-couchdb-1

At this point, accessing http://localhost:8080/ takes you to the following screen.

Configuration

After installing SW360 successfully, you need to perform the initial configuration following the procedure below. For details, see: SW360 Initial Setup Configuration

id : setup@sw360.org
pw : sw360fossy

Once you log in, a Not Found message appears as shown below.

Click the item icon (cube shape) in the upper right of the screen and select the Control Panel tab.

Enable SECURITY > Password Policies > Default Password Policy > PASSWORD CHANGES > Change Requried.

Then, back in the Control Panel tab, select CONFIGURATION > Instance Settings. This shows the PLATFORM menu.

There, select Users. Then go into the Default User Associations menu, check Apply to Existing Users, and Save.

Now, under Instance Settings > PLATFORM, select User Authentication. Go into General and uncheck all items. (You can check and enable any items needed for administrative purposes.) Then Save.

Finally, you need to enable jQuery and Font Awesome. To do this, go into CONFIGURATION > System Settings in the Control Panel tab, where you can find Third Party under PLATFORM.

Go into Third Party and enable JQuery and Font Awesome respectively.

Restart your browser for the changes to take effect.

2. Import LAR Files

To configure SW360, you need to import the *.lar files. To do this, you need to go into the menu, and the menu button is in the upper left of the screen.

In the menu, go into Publishing > Import.

Click the + button on the right to upload a LAR file. The LAR files are located under the frontend/configuration folder in the SW360 source files. (e.g., https://github.com/haksungjang/sw360/tree/docker_build/frontend/configuration)

First, upload the Public_Pages_7_4_3_18_GA18.lar file and click the Continue button.

On the File Summary screen, you can see the details of the uploaded LAR file.

Change AUTHORSHIP OF THE CONTENT at the bottom to Use the Current User as Author and click the Import button.

You can then see that the import completed successfully.

Similarly, import the Private_Pages_7_4_3_18_GA18.lar file. On the File Summary screen, change PAGES > Private Pages as shown below.

Then select the PERMISSIONS, UPDATE DATA, and AUTHORSHIP OF THE CONTENT items as shown in the image below, and click the Import button to perform the import.

After completing this, click the Home button at the top of the menu.

This takes you to the Welcome to SW360! screen shown below.

Click the Start button to go into the SW360 main screen. (All items are empty at this point.)

3. User Account Configuration (for Testing)

In the SW360 menu, select Admin > User.

In the UPLOAD USERS menu at the bottom of the screen, upload the user list for testing. (The user list for testing can be downloaded here. : test_users_with_passwords_12345.csv )

You can then see that a list of 9 users has been uploaded, as shown below.

Try logging in again with the user@@sw360.org account, one of the users shown in the list. The password is 12345.

Basic Workflow

1. Registering Licenses

When you first install SW360, you need to first register the open source licenses you use frequently. A license includes the following information.

Full Name
Short Name
License Type
GPL-2.0 Compatibility (e.g., yes, no)
License Text

Selecting Menu > Licenses > Add License takes you to the Create License screen shown below.

Registering licenses one by one manually like this can be quite tedious, but fortunately SW360 provides a feature to import the SPDX License List all at once. Click Menu > Admin < Import SPDX Information.

The SPDX License List is then automatically registered shortly after. At Menu > Licenses, you can confirm that 338 licenses have been registered.

2. Registering Components and Releases

In SW360, a Component is a single unit of software. Various forms of software can fall into this category, for example:

Open source software
Libraries
Third-party software

A Component includes the following information.

Component Name
Main Licenses
Categories (e.g., Library, Cloud, Mobile, …)
Component Type (e.g., OSS, Internal, InnerSource, Service, Freeware)
Default Vendor
Homepage URL

A Release is the unit that refers to a single Version within a Component. Accordingly, one Component can have multiple Releases. A Release is created and managed under a single Component.

A Release includes the following information.

Component Name
Version
License
Download URL
CPE ID (e.g., cpe:2.3:a:apache:maven:3.0.4)

For example, if you need to register zlib-1.2.8, you first register zlib as a Component, then register zlib 1.2.8 as a Release. Selecting Menu > Components > Add Component takes you to the Create Component screen, where you can register information about zlib.

Once you create the Component, you can register information for the zlib-1.2.8 version at Components > Releases > Add Release.

When versions 1.2.8 and 1.2.11 are each registered as Releases under the single zlib Component, the Release Overview screen shows 2 Releases existing, as below.

SW360 provides a feature for importing information for multiple Components at once. At Menu > Admin > Import / Export, you can enter the Component information you want to register into the CSV template and then import it.

Note that, as of February 2020, this feature may not yet work reliably.

3. Creating a Project

A Project refers to a single product. Depending on the type of business, it may be a product, a service, or software. Under a Project, you register and manage the Components/Releases used in the product.

When creating a Project, you register the following information.

Project Name
Version
Project type (e.g., Product, Customer Project, Service, Internal Project, InnerSource)

You can create a Project via Menu > Projects > Add Project.

Once you create the Project, register the Releases or sub-Projects it includes. Selecting the Project at Menu > Projects lets you register Linked Projects and Linked Releases under “Linked Releases and Projects.”

The following is the screen after registering OpenSSL 1.0.1 and zlib 1.2.8 as Linked Releases in a Project named SuperCalc.

4. Security Vulnerability Management

SW360 can automatically check whether registered Releases have security vulnerabilities. To do this, SW360 provides a feature for scheduling periodic collection of CVE information. At Menu > Admin > Schedule, you can set a schedule to collect CVE SEARCH information every 24 hours.

Once this schedule is set, SW360 collects CVE information from the CVE Search site (https://cve.circl.lu/) at the scheduled time. The collected CVE information can be checked at Menu > Vulnerabilities.

Once the Vulnerabilities information has been collected, you can query whether a created Project has security vulnerabilities. In the SuperCalc Project created above, you can confirm that 85 security vulnerabilities were reported.

By registering and managing the software a company develops and distributes in SW360 this way, you can manage it in a form that minimizes risk not only for open source compliance but also for security vulnerabilities.

SW360 also offers most of its functionality via a REST API in addition to the Web Interface above, making integration with other tools such as FOSSology possible. : https://github.com/eclipse/sw360/wiki/Dev-REST-API

In other words, integrating this into DevOps by, for example, importing the analysis results of a source code scanning tool into SW360, and automating the registration of Projects and Releases, would greatly increase efficiency.

3 - FOSSLight

FOSSLight is an open source project led by LG Electronics that uses various scanners to analyze source code, binaries, and dependencies, and generates a Software Bill of Materials (SBOM). In particular, FOSSLight Hub supports the compliance process by providing open source management, license management, and vulnerability management functions.

1 Introduction to FOSSLight

Key Features:
- Integration of various scanners: integrates and uses various open source scanners such as ScanCode Toolkit, SPDX Tools, CycloneDX, and Fossology
- Support for various analysis targets: supports various analysis targets such as source code, binaries, container images, and Linux packages
- SBOM generation and management: generates and manages SBOMs in various formats (SPDX, CycloneDX, Excel, Text)
- License information detection and management: accurately detects and manages open source license information
- Vulnerability information integration: integrates with external vulnerability databases such as NVD and CVE to provide vulnerability information
- FOSSLight Hub: provides open source management, license management, and vulnerability management functions through a web-based UI
Advantages:
- High extensibility: various scanners can be integrated and used as plugins
- Web-based UI: provides a user-friendly interface through FOSSLight Hub
- Support for various report formats: reports can be generated in various formats such as SPDX, CycloneDX, Excel, and Text
- Open source license
Disadvantages:
- Complex initial setup: initial setup can be somewhat complex because various scanners need to be integrated
- FOSSLight Hub installation required: FOSSLight Hub must be installed separately to use the web-based UI

2 Installing FOSSLight

FOSSLight consists of FOSSLight Scanner and FOSSLight Hub. FOSSLight Scanner runs various scanners to generate analysis results, while FOSSLight Hub provides a web-based UI that integrates, manages, and visualizes the scanner results.

This section explains how to install FOSSLight Scanner and FOSSLight Hub together using Docker Compose.

Install Docker and Docker Compose:
- Before installing FOSSLight, confirm that Docker and Docker Compose are installed on the system.
- Docker installation instructions vary by operating system, so refer to the official Docker documentation (https://docs.docker.com/get-docker/).
- Docker Compose is a tool for running and managing multiple containers simultaneously using Docker. For Docker Compose installation instructions, refer to the official Docker documentation (https://docs.docker.com/compose/install/).
Clone the FOSSLight Repository:
- Run the following command to clone the FOSSLight GitHub repository.
```
git clone <https://github.com/fosslight/fosslight_hub.git>
cd fosslight_hub
```

Configure the Docker Compose File:

The fosslight_hub directory contains a docker-compose.yml file. You can open this file in a text editor and change the FOSSLight Hub configuration.

version: "3.7"
services:
  fosslight_db:
    image: mariadb:10.6.4
    container_name: fosslight_db
    volumes:
      - fosslight_db:/var/lib/mysql
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=fosslight
      - MYSQL_DATABASE=fosslight_db
      - MYSQL_USER=fosslight
      - MYSQL_PASSWORD=fosslight

  fosslight_web:
    image: fosslight/fosslight_hub:latest
    container_name: fosslight_web
    ports:
      - "8080:8080"
    restart: always
    environment:
      - FOSSLightDB_HOST=fosslight_db
      - FOSSLightDB_PORT=3306
      - FOSSLightDB_USER=fosslight
      - FOSSLightDB_PASSWORD=fosslight
      - FOSSLightDB_NAME=fosslight_db
    depends_on:
      - fosslight_db

  fosslight_scanner:
    image: fosslight/fosslight_scanner:latest
    container_name: fosslight_scanner
    restart: always
    volumes:
      - ./upload:/home/fosslight_scanner/upload
      - ./result:/home/fosslight_scanner/result
volumes:
  fosslight_db:

You can change the port number, database settings, and so on as needed.

Run FOSSLight:
- Run the following command to start FOSSLight.
```
docker-compose up -d
```
- This command runs FOSSLight Hub, FOSSLight Scanner, and the MariaDB database as Docker containers.
Verify the FOSSLight Installation:
- In a web browser, access http://localhost:8080 to confirm that you can reach FOSSLight Hub.
- If the FOSSLight Hub web UI is displayed, the installation completed successfully.
Figure 2.1: FOSSLight Hub Web UI
(Insert screenshot of the FOSSLight Hub web UI)

3 FOSSLight Usage Guide

FOSSLight can be used through a web UI (FOSSLight Hub) and a CLI (FOSSLight Scanner).

3.1 Using FOSSLight Hub

FOSSLight Hub provides functionality, through a web UI, to manage open source projects, check scan results, and generate various reports.

Register a Project:
- Access FOSSLight Hub and register a new project.
- Enter information such as the project name, description, and owner.
Figure 2.2: FOSSLight Hub Project Registration Screen
(Insert screenshot of the FOSSLight Hub project registration screen)
Upload Scan Results:
- Upload the scan results generated using FOSSLight Scanner to FOSSLight Hub.
- The scan result file must be in SPDX, CycloneDX, or FOSSLight JSON format.
Figure 2.3: FOSSLight Hub Scan Result Upload Screen
(Insert screenshot of the FOSSLight Hub scan result upload screen)
Check Scan Results:
- Check the uploaded scan results.
- FOSSLight Hub visually presents SBOM information, license information, and vulnerability information.
Figure 2.4: FOSSLight Hub Scan Result Review Screen
(Insert screenshot of the FOSSLight Hub scan result review screen)
Generate Reports:
- Generate various reports based on the scan results.
- You can choose the report format: SPDX, CycloneDX, Excel, or Text.
Figure 2.5: FOSSLight Hub Report Generation Screen
(Insert screenshot of the FOSSLight Hub report generation screen)

3.2 Using FOSSLight Scanner

FOSSLight Scanner provides functionality, through the CLI, to scan source code, binaries, and container images and generate an SBOM.

Run a Scan:
- Run the following command to execute a scan.
```
docker run --rm -v $(pwd)/upload:/home/fosslight_scanner/upload -v $(pwd)/result:/home/fosslight_scanner/result fosslight/fosslight_scanner -p /home/fosslight_scanner/upload/<scan target> -o /home/fosslight_scanner/result/<result file name> -f <result format>
```
- Each option is explained as follows.
  - -rm: automatically removes the container after it runs.
  - v $(pwd)/upload:/home/fosslight_scanner/upload: shares the upload directory in the current directory with the /home/fosslight_scanner/upload directory inside the container. You need to copy the file or directory to be scanned into this directory.
  - v $(pwd)/result:/home/fosslight_scanner/result: shares the result directory in the current directory with the /home/fosslight_scanner/result directory inside the container. The scan result file is saved to this directory.
  - p /home/fosslight_scanner/upload/<scan target>: specifies the path to the file or directory to be scanned.
  - o /home/fosslight_scanner/result/<result file name>: specifies the name of the scan result file.
  - f <result format>: specifies the scan result format (spdx, cyclonedx, fosslight_json).
- Example:
```
docker run --rm -v $(pwd)/upload:/home/fosslight_scanner/upload -v $(pwd)/result:/home/fosslight_scanner/result fosslight/fosslight_scanner -p /home/fosslight_scanner/upload/my_project -o /home/fosslight_scanner/result/my_project_sbom.json -f fosslight_json
```
Check the Scan Results:
- Once the scan completes, the scan result file is generated in the result directory.
- You can check the scan result file using a text editor or FOSSLight Hub.

4 Precautions When Using FOSSLight

Because FOSSLight integrates and uses various scanners, you need to understand the characteristics and usage of each scanner.
Because FOSSLight Hub requires a web server and a database, you need to install it with system resource requirements in mind.
FOSSLight Scanner requires permission to access the file or directory being scanned.

5 Troubleshooting

Docker execution error: confirm that Docker is installed correctly, and check for permission issues.
- Try running with administrator privileges using the sudo docker run ... command.
Scan error: confirm that the path to the file or directory being scanned is correct, and check that you have permission to access that file or directory.
FOSSLight Hub access error: confirm that the Docker container is running properly, and check that the port forwarding is configured correctly.

6 Additional Information

FOSSLight official website: https://fosslight.org/
FOSSLight GitHub repository: https://github.com/fosslight/fosslight_hub
SPDX official website: https://spdx.dev/
CycloneDX official website: https://cyclonedx.org/

4 - OSV-SCALIBR

OSV-SCALIBR (Software Composition Analysis LIBRary) is an open source software composition analysis library developed by Google. It supports various programming languages and aims to provide fast and accurate analysis results. It offers core functionality for generating a Software Bill of Materials (SBOM), but because it is provided as a library rather than as a standalone executable, users need to write their own code to integrate it.

1 Introduction to OSV-SCALIBR

Key Features:
- Support for various programming languages (Python, Go, Java, etc.)
- Analysis of package manifest files (requirements.txt, pom.xml, go.mod, etc.)
- Dependency information extraction
- Vulnerability information integration (using the OSV database)
- Fast analysis speed
Advantages:
- Support for various programming languages
- Fast analysis speed
- Provides the latest vulnerability information through OSV database integration
- Flexible integration possibilities
- Open source license
Disadvantages:
- Provided as a library rather than as a standalone executable
- Users need to write their own code to integrate it
- SBOM generation functionality must be implemented directly
- Lack of documentation and community support

2 Installing OSV-SCALIBR

Because OSV-SCALIBR is provided as a library, you need to install it through the package manager appropriate for the programming language you intend to use. This guide explains how to install it in a Python environment.

Confirm Python and pip Are Installed:
- Before installing OSV-SCALIBR, confirm that Python and pip are installed on the system.
- Run the following command in the command prompt or terminal to check the Python version.
```
python --version
```
- Python 3.7 or higher must be installed.
- To check the pip version, run the following command.
```
pip --version
```
- If Python and pip are not installed, download and install them from the official Python website (https://www.python.org/downloads/).
Install OSV-SCALIBR:
- Run the following command to install the OSV-SCALIBR library.
```
pip install osv-db
```
Verify the Installation:
- Run the Python interpreter and enter the following code to confirm that OSV-SCALIBR was installed correctly.
```
import osv
print(osv.__version__)
```
- If the OSV-SCALIBR version information is printed, the installation completed successfully.

3 OSV-SCALIBR Usage Guide

Because OSV-SCALIBR is provided as a library, you need to write your own code to generate an SBOM. The following is a basic example of generating an SBOM using OSV-SCALIBR in a Python environment.

Install Required Libraries:
- In addition to osv-db, install the libraries needed to generate an SBOM (e.g., spdx-tools).
```
pip install spdx-tools
```

Write the Code:

The following is example code that extracts dependency information from a requirements.txt file, checks vulnerability information using OSV-SCALIBR, and then generates an SBOM in SPDX format.

import osv
from spdx_tools.spdx.model import Document, Package
from spdx_tools.spdx.builder import Builder
from spdx_tools.spdx.validation.document_validator import validate_full
import os

def create_sbom_from_requirements(requirements_file):
    """
    Extracts dependency information from a requirements.txt file,
    checks vulnerability information using OSV-SCALIBR, and then
    generates an SBOM in SPDX format.
    """

    # 1. Read the requirements.txt file
    dependencies = []
    with open(requirements_file, "r") as f:
        for line in f:
            line = line.strip()
            if line and not line.startswith("#"):
                package_name, package_version = line.split("==")
                dependencies.append((package_name, package_version))

    # 2. Create the OSV API client
    client = osv.Client()

    # 3. Create the SPDX document
    document = Document(
        spdx_version="SPDX-2.2",
        data_license="CC0-1.0",
        spdx_id="SPDXRef-DOCUMENT",
        name="SBOM for " + requirements_file,
    )
    document.creators = ["Tool: OSV-SCALIBR Example Script", "Organization: Your Organization"]

    # 4. Add package information and check vulnerability information
    for package_name, package_version in dependencies:
        # Query vulnerability information using the OSV API
        vulnerabilities = client.get_vulnerabilities(package_name, package_version)

        # Create the package
        package = Package(
            name=package_name,
            spdx_id=f"SPDXRef-Package-{package_name}",
            version=package_version,
            # TODO: License information needs to be added.
        )

        # If vulnerability information exists, add a comment
        if vulnerabilities:
            comment = f"Vulnerabilities found: {len(vulnerabilities)}"
            package.comment = comment

        document.packages.append(package)

    # 5. Validate and output
    validation_messages = validate_full(document)
    if validation_messages:
        print("Validation errors:")
        for message in validation_messages:
            print(message)
    else:
        # Convert the SPDX document to a string (using spdx-tools)
        from spdx_tools.spdx.writer.write_anything import write_anything
        output_file = "sbom.spdx"
        write_anything(document, output_file, "tag", check_licenses=False)
        print(f"SPDX document generated successfully! File: {output_file}")

# Example run
# The requirements.txt file must be in the current directory.
if os.path.exists("requirements.txt"):
    create_sbom_from_requirements("requirements.txt")
else:
    print("Error: could not find the requirements.txt file.")

Run the Code:
- Save the code above as a Python file (e.g., sbom_generator.py), and run the following command.
```
python sbom_generator.py
```
Check the Results:
- If the code runs successfully, a sbom.spdx file is generated. This file contains the SBOM written in SPDX format.

4 Precautions When Using OSV-SCALIBR

Because OSV-SCALIBR is provided as a library, you need to write your own code to generate an SBOM.
Because OSV-SCALIBR does not provide every function needed for SBOM generation, you need to implement the required functionality yourself or use it together with other libraries.
OSV-SCALIBR’s documentation can be somewhat lacking, and community support may not be very active.
The code example generates an SBOM based on a requirements.txt file, but a real environment may need support for various package managers.
The code example does not add license information directly. In an actual SBOM, you need to accurately determine and add the license information for each package.

5 Example of a Generated SBOM (Inferred)

An SBOM (in SPDX format) generated using OSV-SCALIBR would have a structure like the following. (The actual content depends on the contents of the requirements.txt file.)

SPDXVersion: SPDX-2.2
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
Name: SBOM for requirements.txt
Creator: Tool: OSV-SCALIBR Example Script
Created: 2025-02-11T00:00:00Z

# Package Information
PackageName: requests
SPDXID: SPDXRef-Package-requests
PackageVersion: 2.28.1
# Comment: Vulnerability found: 1 (may vary depending on the OSV database)

PackageName: urllib3
SPDXID: SPDXRef-Package-urllib3
PackageVersion: 1.24.13

# Relationships
# (Dependency relationship information between each package)

Note: the example above merely shows the format of an SBOM that OSV-SCALIBR could generate; the actual SBOM content depends on the code and the dependency analysis results. Additional information such as license information and origin information needs to be added by modifying the code directly.

6 Additional Information

OSV-SCALIBR GitHub repository: (no information)
OSV (Open Source Vulnerabilities) database: https://osv.dev/
SPDX official website: https://spdx.dev/

Caution: because OSV-SCALIBR is a library, this guide alone may not be enough to complete SBOM generation. It requires an understanding of Python programming and SBOM generation, along with additional code.

Tools

1 - FOSSology

Key Features

Installation

Test Server

Basic Workflow

2 - SW360

Key Features

Installation

1. Download the Code

2. Build

3. Run

Configuration

1. User and Login Configuration

2. Import LAR Files

3. User Account Configuration (for Testing)

Basic Workflow

1. Registering Licenses

2. Registering Components and Releases

3. Creating a Project

4. Security Vulnerability Management

3 - FOSSLight

1 Introduction to FOSSLight

2 Installing FOSSLight

3 FOSSLight Usage Guide

4 Precautions When Using FOSSLight

5 Troubleshooting

6 Additional Information

4 - OSV-SCALIBR

1 Introduction to OSV-SCALIBR

2 Installing OSV-SCALIBR

3 OSV-SCALIBR Usage Guide

4 Precautions When Using OSV-SCALIBR

5 Example of a Generated SBOM (Inferred)

6 Additional Information