Administration Guide

Procedure

1. To create an SBOM by using a container image.

   CycloneDX format

   syft IMAGE_PATH -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   SPDX format

   syft IMAGE_PATH -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   $ syft registry:example.io/hello-world:latest -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   Note

   Syft supports many types of container image sources. See the official supported source list on Syft’s GitHub site.

2. To create an SBOM by scanning the local file system.

   CycloneDX format

   syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
   syft file: FILE_PATH -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   $ syft dir:. -o cyclonedx-json@1.5
   $ syft file:/example-binary -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   SPDX format

   syft dir: DIRECTORY_PATH -o spdx-json@2.3
   syft file: FILE_PATH -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   $ syft dir:. -o spdx-json@2.3
   $ syft file:/example-binary -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

Procedure

1. Open a web browser.
2. Go to the Trusted Profile Analyzer console URL for your running RHTPA instance.
3. Log in to the Trusted Profile Analyzer console with your credentials.
4. Click SBOMs from the navigation menu.
5. Click the Generate vulnerability report button.
6. You can drag and drop your SBOM file directly to this page, or click the Browse Files button, then choose the SBOM file you want to scan.
7. After RHTPA scans the SBOM file, you get a summary of the analysis, and any specific vulnerability information for the packages included in your SBOM file.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, click Search from the navigational menu.
3. In the search field enter your search query.
4. On the search results page, you can view SBOM documents, software packages, vulnerabilities, and advisories related to your search query. You can also filter these results by date range, SBOM format, and license expression.

Procedure

1. Open a web browser, and log in to the {acroynm} console.
2. From the home page, click Search from the navigational sidebar.
3. Find your SBOM from the list.
4. Click the options menu icon, and click Download License Export.
5. Extract the license information from the downloaded .zip file.

6. Open the comma-separated values (CSV) file to view it.

   Note

   The license reference CSV file only applies to SPDX-formatted SBOMs.

Procedure

1. From the RHTPA console home page, click either SBOMs or Advisories on the navigation menu.
2. On the row for the SBOM or advisory you want to edit labels for, click the overflow menu at the end of the row, and click Edit labels.

3. On the Edit labels page, you can add or remove labels.

   1. To add a new label, start typing the label name in the Label field, and click the Add button.
   2. To remove a label, look under the Labels of SBOM section, click the X on the label you want to remove.
4. When finished editing the labels for SBOMs or advisories, click the Save button.

Procedure

1. Open a web browser, and log in to the RHTPA console.
2. From the home page, click SBOM or Advisories from the navigational menu.
3. Find your SBOM or advisory in the list, click the options menu icon, and click Delete.
4. A confirmation dialog is given, click the Delete button.
5. Verify that the SBOM or advisory no longer appears in the list.