generate sbom for c++ project that use custom make file

[mehrdad2000]

Hi
have an c++ project that use custom make file to build.
How can I create sbom for this project?

FYI: I don't want to use Cmake.

Any Idea?
Thanks

[tgerla]

Hi, could you tell us a bit more about this project? You don't need to use cmake to use syft. You can invoke syft from your build process. If you can show us what you've tried so far, we can help you get going.

[mehrdad2000]

@tgerla i have legacy code that can’t change make procedures on it.
This project in c++, and contains several directories that each directory has it’s own make file.
I put script in root of project that “cd” to each directory and run “make; clean make”

[tgerla]

I think you could add the syft commands to your script in the root of the project, after the "make" steps? I apologize if I am not understanding fully. Feel free to show the script you're using and we can try to help further.

[tgerla]

I also spoke to my engineering team about your question and I got a few more details. Syft won't actually detect any packages on a basic C++ project unless you are using the Conan package manager (https://conan.io/). However, you can create an SBOM manually and include it in your project, and Syft can find that and use it to populate the final results. I hope this helps--feel free to join our Slack to chat with us, if you would like!

[mehrdad2000]

@tgerla would please tell me in simple scenario i have one directory that contain one make file.
How can i use conan in this simple scenario?

[tgerla]

Hi @mehrdad2000, sorry I am not a Conan expert and I'm not sure it's applicable to your project. I just know that Syft can use it as a data source to look for 3rd party C++ packages if your project already uses it to organize dependencies. Think of Conan as NPM for C++, for instance.

Maybe we could take a step back? It sounds like you are trying to create an SBOM for your own project, right? Does your project contain 3rd party C++ dependencies? What is your goal for the SBOM?

[tgerla]

We'll go ahead and close this issue, but feel free to re-open or open another one if you need additional help. We are also available in our Slack channel if you'd like to chat. Thanks!