Visualizing your SBOMs via graph...


Introduction 

pyspdxtools is a Python library and command-line tool that provides utilities for working with Software Bill of Materials (SBOM) files in the SPDX (Software Package Data Exchange) format. SPDX is a widely adopted standard for documenting the open-source software components used in a project, along with associated metadata such as licenses, copyrights, and relationships between components. 

Why Generate a Graph from an SBOM? 

 
Visualizing an SBOM as a graph helps you quickly understand the relationships between components, dependencies, and packages. By generating a graph, you can: - 
  • Identify Key Dependencies: Easily spot core libraries or components that are crucial to the software. 
  • Understand Relationships: Visualize how different packages are connected, including dependencies and sub-dependencies.

With this tutorial, you’ll be able to generate such a graph from your SPDX SBOM using `pyspdxtools`, making it easier to analyze and present your software’s component relationships.

pyspdxtools Installation:

 Here’s a step-by-step tutorial to install `pyspdxtools`, set up the required dependencies, and generate a graph from an SPDX SBOM. 
 
Prerequisites 
  •  Python 3.7+: Ensure you have Python 3.7 or later installed. 
  •  Pip: Make sure `pip` is installed to manage Python packages. 

Step 0: Clone the Repository 


$ git clone git@github.com:spdx/tools-python.git
$ cd tools-python

Step 1: Set Up a Virtual Environment (Optional but Recommended) 

Create and activate a virtual environment to avoid conflicts with other Python packages. 

$ python3 -m venv spdxenv
$ source spdxenv/bin/activate
 

Step 2: Install `pyspdxtools` and Required Dependencies First, install the base package: 


$ pip install .

Check if `pyspdxtools` is installed or not: 

$ pyspdxtools --help 


To generate graphs, you need additional dependencies: `networkx` and `pygraphviz`. Install these using the following command: 


$ sudo apt-get install graphviz libgraphviz-dev $ pip install ".[graph_generation]" 


Step 3: Generate a Graph from Your SPDX SBOM 


Before generating the graph, validate your SBOM to ensure it’s correct: 

$ pyspdxtools -i <path_to_your_sbom>

 
If there is no output, it means your SBOM is correct. 
Now, generate the graph: 

$ pyspdxtools -i <path_to_your_sbom> --graph -o output.png


 Note: Replace `<path_to_your_sbom>` with the path to your SPDX SBOM file. The `output.png` will be the file where the graph is saved. 

Step 4: View the Generated Graph 


After running the command, view the graph using: 

$ xdg-open output.png # On Linux 


or simply double click that file to see the full image.

Example 

Suppose you have an SBOM file located at `~/sbom/sbomqs-linux.spdx.sbom.json`. Run the following: 

$ pyspdxtools -i ~/sbom/sbomqs-linux.spdx.sbom.json --graph -o sbom_graph.png 


This will generate a file named `sbom_graph.png` containing the graphical representation of your SBOM. Finally, open it with: 

$ xdg-open sbom_graph.png # Linux 

 

Conclusion 


This tutorial guides you through installing `pyspdxtools`, setting up the necessary dependencies, and generating a graph from your SBOM. With this, you can easily visualize your SBOM data and gain insights into the relationships between components. 

Comments

Post a Comment

All Post

Logging ??

Image
 Today we will learn about the following things: What is logging ?? Why do we need logging ?? How can logging help us ?? Why suddenly from the last 5-10 years logging has been evolving ?? Logging tools ?? First thing first, let's start with logging. Logging is human-readable information that is primarily text in nature. Logging is triggered or generated when some kind of event occurs, such event is known as a log event.  Each logging message contains the timestamp, which signifies the time at which the event occurred. Now let, us understand why we need logging.  Importance of logging ?? In today's world software all around the world captures the whole market. By definition, Software is a program that is made up of millions of lines of code.  The programmer while writing the code adds the logs at all places to know the code behaviors as well as unexpected ones.  The logs can be of types such as ERROR, WARN, INFO, FATAL, DEBUG, TRACE, etc.     NOTE : Logs are also added to know w
Read more

Argo CD 101

Image
Why Argo CD ?? Because it fulfills all the points of the GitOps principle . As it extends the benefits of declarative specifications, acting as a GitOps Operator, follows a pull-based approach,  and considers Git as a source of truth for configuration management. It follows a pattern of reconciliation i.e. continuously performing a control loop every 3 minutes to achieve the desired state by fetching the desired configuration from Git. Let’s understand it in more detail, how can we achieve or implement GitOps using Argo CD ?? We all know that every company and every developer uses Git as a source code management software to store code. Developers can commit their infrastructure configurations, such as Kubernetes resource manifest, in Git to create the environment needed for application deployment. Once a developer implements a feature( with new applications and Kubernetes configurations) and merges the main branch. With the help of the GitOps agent or GitOps operator, Argo CD will imme
Read more

What is GitOps in easy way ??

Image
Here we will discuss: "What is GitOps", and "What are its 4 important principles". And lastly, "Why GitOps operator follow a pull-based model ?". What is GitOps ?? GitOps is made up of two words: Git and Ops . Git is where you keep your desired manifest(or configurations) that you want to deploy in your cluster(or environment). And Ops refers to Operation. Operation refers to the environment where the things are operated to ensure that the actual state or live state of that environment must be the same as the desired state in the git. To achieve that from the actual state to the desired state an operation is performed inside the environment.  Such an environment could be a Kubernetes cluster. So, anything that you want to deploy in the Kubernetes simply put it in the git. From git, the GitOps operator(i.e. Argo CD) will deploy to the Kubernetes cluster. To understand the GitOps better we need to understand 4 principles of it: 4 Principles of GitOps: 1.
Read more

Why need of Cloud Computing ??

Image
  Do you recall the result day of your class 10th and 12th? I believe you do. One thing that caught everyone's attention was the server being down when you accessed the website to check the results. Have you ever wondered why the server experienced downtime?   What was the underlying reason for it? Before we proceed, it's essential to grasp the concept of  servers  and  requests . A server can be a single laptop/computer/node or a cluster of laptops/computers that offer specific services. In this scenario, the server was responsible for running the CBSE   board website through which you could access your results. And second thing it was publicly accessible from the Internet. Another important aspect to consider is the concept of a request. A request is like a command that initiates the execution of a program. When you enter your roll number , name , etc., and press the submit button, it counts as one request. This request is sent to the server, prompting it to execute the
Read more

AWS and its Services ??

Image
So, in a previous blog, we learned about cloud computing and its importance . Here we will start with the popular cloud service provider, Amazon Web Services(AWS).  AWS or Amazon Web Services is a cloud service provider that offers various cloud computing services that are accessible via the public internet. The popular services provided by AWS are:  Virtual machine(EC2),  Virtual Network(VPC), Restrict access to cloud resources(IAM), etc.  Executing functions(Lambda),  Automating your infrastructure(CloudFormation),  Object Storage(S3),  Block Storage for Virtual Machines(EBS),  Running and Managing Containers(ECS and fargate),  Network Filesystem(EBS),  SQL database(RDS),    Load Balancer(ELB),   Monitoring and logging(CloudWatch),  We will learn these services one by one.  In this blog, we will cover Virtual Machines (EC2). These services can be accessed in four ways: Console :  access AWS services through a graphical user interface (GUI) CLI :    to manage and access AWS services
Read more

Build a Slack activity dashboard with Metabase

Image
Introduction In this article, we will be leveraging Airbyte - an open-source data integration platform and Metabase - an open-source way for everyone in your company to ask questions and learn from data - to build the Slack activity dashboard above. Airbyte provides us with a rich set of source connectors, and one of those is the Slack connector which allows us to get data off a Slack. We are going to use this connector to get the data of the Slack Workspace and copy them into a Postgres database destination. And then will connect Postgres database with Metabase in order to create the activity dashboard. Pre-requisites: Git Docker Docker Compose Airbyte Postgres Database Metabase Slack Step 1: Replicating data from Slack to Postgres with Airbyte Deploying Airbyte There are several easy ways to deploy Airbyte, as listed here. For this tutorial, I will just use the Docker Compose method from my workstation:  ``` $ git clone https://github.com/airbytehq/airbyte.git $ cd airbyte $ docke
Read more

Prometheus Architecture...

Image
  Prometheus Architecture Look at the below figure, and we can see that Prometheus has major 3 things:  to pull Metrics ,  store it in the Time-Series database , a nd  allow third parties to retrieve metrics using PromQL Metrics are mainly pulled from 3 sources: PushGateway , Exporters , and Instrumentation . These pulled metrics are then stored in a time-series database. Later time-series stored metrics are used by third parties such as Prometheus Web UI ,  Alertmanager , and Grafana . Components of Prometheus: There are 3 main components of Prometheus: Retrieval/Pull Metrics This component of Prometheus is mainly responsible for pulling metrics from targets. Targets can be exporters ,   instrumentation , and pushgateway . Time Series Database Once the retrieval collects data from the target, then it transfers to a time-series database. The data are stored in the form of a metric. Each metric is identified by its name and labels. HTTP Server It allows collected time-series data from
Read more

Observability 101

Image
Hey Everyone !! Good to see you all here to learn Prometheus. This blog is the prerequisite to learning Prometheus.  Prometheus is a part of Observability. Before wasting our time, let's jump into the topic called Observability. Observability Fundamentals What is Observability ?? Observability == Observe + Ability. Observability is made up of 2 words: Observe and Ability .  Observe means to observe the data generated from the system, and the ability  means to measure and understand the system's state based on the generated data.  In the broader sense, Observability gives you the insight of the system's internal working of each component. And that helps while troubleshooting an issue. From where does the concept of Observability come in?? In the early days when applications were deployed in Monolithic structures, humans were able to monitor each component present in the system/server due to the limited number of components. As the microservice application started to boom,
Read more

Monitoring 101

What is Monitoring ?? Monitoring refers to a tool that collects metrics data, provides a dashboard to visualize the collected data, and generates alerts based on alerting rules.  Monitoring tool =~ Metrics + Visualization + Alerting Monitoring can be done in 2 ways: Blackbox Monitoring Whitebox Monitoring BlackBox Monitoring In this type of monitoring, Applications or Systems are monitored/observed from outside via APIs.  Whitebox Monitoring In this type of monitoring, Applications or Systems are monitored or observed from inside. Here, the system itself is under observation which exposes its internal state data and performance data of the system. This type of internal introspection is very powerful because it exposes the operating system telemetry and the health of each different internal component.  So after collecting internal state data, now we need to know,  what are different ways to expose or send these data ? There are 3 different ways to expose the data: Exported through loggi
Read more

Computer Networking 101

Image
Hello Everyone !! I hope you are doing well. We all know the importance of the Internet world. But how does that happen? In the series on Computer Networking we will learn the following topics: What is the Client-Server model? What is Internet Protocol? How does our device connect to Wi-Fi or Hotspot? What happens when you search for www.google.com , www.facebook.com , www.amazon.com , www.linkedin.com , www.github.com , www.youtube.com ,etc?
Read more