CycloneDX::Parser - Parser for CycloneDX SBOMs
version 0.01
my $parser = CycloneDX::Parser->new( json => $file );
# or
my $parser = CycloneDX::Parser->new( json_string => $json_string );
if ( $parser->is_valid ) {
my $data = $parser->sbom_data;
}
else {
my @errors = $parser->errors;
...
}This module parses CycloneDX Software Bill of Materials (SBOMs), version 1.5 JSON. It is a work in progress.
Eventually earlier versions will be supported, but for now, trying to get it working and seeing how the design evolves. The code is written with core Perl because with the upcoming Cyber Security Act (CRA) in the EU, open-source code may become a liability for many companies. By starting to build out programmatically discoverable Software Bill of Materials (or SBOMs), we can make it easier for companies to comply with the CRA.
Non-compliance with CRA can mean fines for companies of €15 million, or 2.5% of global revenue, whichever is higher. This will give many companies a major incentive to avoid using open-source, since much of it is not designed to be easily audited.
my $parser = CycloneDX::Parser->new( json => $file );
# or
my $parser = CycloneDX::Parser->new( json_string => $json_string );Creates a new parser object. The only argument is a hashref with a single key.
Thay key is json and the value is the JSON file to parse. If you wish to
pass in raw JSON instead of a file, use the json_string key instead.
if ( $parser->is_valid ) {
...
}
Returns true if the SBOM is valid (warnings are OK, but errors means it's invalid).
my @errors = $parser->errors;Returns a list of errors as printable strings. If the SBOM is valid, the list will be empty.
my @warnings = $parser->warnings;Returns a list of warnings as printable strings. If there are no warnings, the list will be empty.
my $data = $parser->sbom_data;Returns a hashref of the SBOM data as_is. Note that this is mutable, so changing the data
means you should call $self->validate again.
Curtis "Ovid" Poe curtis.poe@gmail.com
This software is Copyright (c) 2023 by Curtis "Ovid" Poe.
This is free software, licensed under:
The Artistic License 2.0 (GPL Compatible)