Dotnet tool for manipulating SPDX SBOM files
The following will add SpdxTool to a Dotnet tool manifest file:
dotnet new tool-manifest # if you are setting up this repo
dotnet tool install --local DemaConsulting.SpdxTool
The tool can then be executed by:
dotnet spdx-tool <arguments>
The following shows the command-line usage of SpdxTool:
Usage: spdx-tool [options] <command> [arguments]
Options:
-h, --help Show this help message and exit
-v, --version Show version information and exit
Commands:
help <command> Display extended help about a command
add-package Add package to SPDX document (workflow only).
add-relationship <spdx.json> <args> Add relationship between elements.
copy-package <spdx.json> <args> Copy package between SPDX documents (workflow only).
diagram <spdx.json> <mermaid.txt> Generate mermaid diagram.
find-package <spdx.json> <criteria> Find package ID in SPDX document
get-version <spdx.json> <criteria> Get the version of an SPDX package.
hash <operation> <algorithm> <file> Generate or verify hashes of files
print <text> Print text to the console
query <pattern> <program> [args] Query program output for value
rename-id <arguments> Rename an element ID in an SPDX document.
run-workflow <workflow.yaml> Runs the workflow file/url
set-variable Set workflow variable (workflow only).
to-markdown <spdx.json> <out.md> [args] Create Markdown summary for SPDX document
update-package Update package in SPDX document (workflow only).
validate <spdx.json> [ntia] Validate SPDX document for issues
A more detailed description of the usage can be found here
The SpdxTool can be driven using workflow yaml files of the following format:
# Workflow parameters
parameters:
parameter-name: value
# Workflow steps
steps:
- command: <command-name>
inputs:
<arguments mapping>
- command: <command-name>
inputs:
input1: value
input2: ${{ parameter-name }}
A more detailed description of workflow YAML files can be found here
Additional information can be found at: