Initial Commit

.gitignore

@@ -0,0 +1,51 @@
+# C++ objects and libs
+
+*.slo
+*.lo
+*.o
+*.a
+*.la
+*.lai
+*.so
+*.dll
+*.dylib
+
+# Qt-es
+/.qmake.cache
+/.qmake.stash
+*.pro.user
+*.pro.user.*
+*.moc
+moc_*.cpp
+qrc_*.cpp
+ui_*.h
+Makefile*
+*-build-*
+
+# QtCreator
+*.autosave
+CMakeLists.txt.user
+
+#QtCtreator Qml
+*.qmlproject.user
+*.qmlproject.user.*
+
+#userstuff
+.directory
+
+CMakeCache.txt
+CMakeFiles/*
+
+# Poetry files
+**/poetry.lock
+**/.python-version
+dist/
+
+# Jetbrains Idea files
+.idea/*
+**/__pycache__/
+**/parsetab.py
+**/parser.out
+
+# Expanded test data
+testdata/*/

.reuse/dep5

@@ -0,0 +1,18 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: icsbom
+Upstream-Contact: ICS SBOM Team <[email protected]>
+Source: https://github.com/integratedcomputersolutions/icsbom
+
+Files: .github/*
+       .gitignore
+       poetry.toml
+       pyproject.toml
+Copyright: Ics inc.
+License: MIT
+
+# Sample paragraph, commented out:
+#
+# Files: src/*
+# Copyright: $YEAR $NAME <$CONTACT>
+# License: ...
+

LICENSES/MIT.txt

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,67 @@
+<!--
+   SPDX-FileCopyrightText: 2024 ICS inc.
+   SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+
+# icsbom [![PyPI version](https://badge.fury.io/py/icsbom.svg)](https://badge.fury.io/py/icsbom) [![REUSE status](https://api.reuse.software/badge/github.com/integratedcomputersolutions/icsbom)](https://api.reuse.software/info/github.com/integratedcomputersolutions/icsbom)
+This application downloads data from the nvd api and creates a local `Vunerability Database`.
+If the database already exists it will be updated with changes since your last update.
+It then uses that data to check the provided sbom file and give you a Vunerability report
+
+## Usage
+ icsbom [OPTIONS] INPUTFILE
+
+### Options
+`-h` Help
+ - Shows the Application Help
+
+`--log` set the log level of the application 
+ - Valid levels: `NOTSET`, `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`
+ - Default value: `WARNING`
+
+`--cache_dir` the path where the application will write 
+ - Any path you can Read and Write to is valid 
+ - Default: `$HOME/.cache/icsbom`
+
+`--api_key` API_KEY
+ - Use the API_KEY to access the NVD Api
+ - A Key is NOT required, providing one allows more api queries per second
+ - If the file `$CACHE_DIR/api_key.txt` exists its contents will be used as the api key
+
+`--save_key`Save the api key used by the `api_key` option
+   - Writes the used api key to `api_key.txt` in the Cache Directory
+
+`--db_file` filename for the database
+ - The filename used will be written into the cache directory
+ - Default: `nvd_v#.db` Where # is the revision of the database format.
+
+`-o` Output file to write
+   - File format depending on extention of the output file
+   - Valid extentions are *.txt, *.csv, *.html, *.json.vex
+
+`-i`, `--interactive` Enter interactive mode after matching
+
+`-s`, `--skip-db-update`
+ - This option will skip the database update and go right to scanning the file using the existing database.
+
+`--filter_file` `FILTER_FILE`
+ - Override the builtin filters with the contents of `FILTER_FILE`
+ - `FILTER_FILE` must be a json file
+
+ `--write_filters` `FILTER_OUT`
+ - Write the default filters to a file
+ - `FILTER_OUT` should end in .json
+ - Useful to adjust the filters for your projects needs.
+
+`-t` TAR_DIR_PATTERN
+ - Used when the input file is a tarball crated by a yocto build process
+ - process the contents of the subdir matching the TAR_DIR_PATTERN
+ - Valid Patterns: recipies, packages
+ - Default: packages
+
+`INPUTFILE` The input file
+ - File can be a sbom or tarball
+
+# Requirements
+ requires ics_sbom_libs
+

icsbom/__init__.py

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Copyright 2024 Ics inc.
+
+from . import icsbom
+
+__all__ = ["icsbom"]
+
+
+def main():
+    icsbom.main()

icsbom/__main__.py

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Copyright 2024 Ics inc.
+
+import icsbom
+
+if __name__ == "__main__":
+    icsbom.main()