Skip to main content
Version: 1.6.1

SBOM reports

You can upload SBOM reports for security checks with the following tools:

  • KCS;
  • OWASP Dependency-Track;
  • Trivy;
  • Grype;
  • CodeScoring SCA;
  • Solar AppScreener SCA;
  • PT AI.

The system supports SBOM reports in the following formats:

  • SPDX;
  • CycloneDX.

Upload an SBOM report​

To upload an SBOM report, follow these steps:

  1. Go to Projects → Project name → Security layers.
  2. Select the required project from the list.
  3. Go to the Security layers tab.
  4. Select the additional actions button (Additional actions) next to the security check.
  5. Select Import SBOM.
  6. In the window that opens, upload the report's JSON file in one of the supported formats.
  7. Select Save.

After that, the interface displays a notification that the SBOM upload has started. The upload may take some time.

note

For more information about exporting reports from security tools or using the command line, see CLI tools.

SBOM processing statuses​

SBOM uploads can have the following statuses:

  1. After you upload the report, its status changes to In progress.
  2. After the system processes the report successfully, its status changes to Processed, and the Dependencies section displays a link to the dependencies it found.

The SBOM upload status appears for each security check in Projects → Project name → Security layers.

You can find the complete list of dependencies in Dependencies.

Examples of exporting reports​

Export a report from CodeScoring​

To export a report from CodeScoring, follow these steps:

  1. Sign in to CodeScoring.
  2. Go to SCA → Projects → Project name.

Export an SBOM from CodeScoring

  1. Select Export SBOM.
  2. Select one of the available versions.

Export an SBOM from CodeScoring

  1. Upload the SBOM report to TRON.ASOC as described in Upload an SBOM report.

Export a report from PT AI​

To export a report from PT AI, follow these steps:

  1. Sign in to PT AI.
  2. Go to Projects.

Export an SBOM from PT AI

  1. Go to the detailed information page for the selected project.
  2. Select Release report.

Export an SBOM from PT AI

  1. In the Release report window, select the JSON report report template.

Export an SBOM from PT AI

  1. Select Release.
  2. Upload the report to TRON.ASOC as described in Upload an external report.