Getting Started: SBOM Generation

Prerequisites

Access to the Manifest Platform
Manifest Platform API Key
Access to the SBOM target
1. Source code: Have the repository cloned locally.
2. Container Have permissions to access the registry on your terminal

Generating SBOMs

Example: Using the CLI (recommended)

To scan (local) repositories, use Manifest's CLI. The complete CLI user guide is here Using the CLI, but here are the quick steps:

Install the CLI

Instructions are found on the Github page for installation of the Manifest CLI

Mac: Apple users can use the recommended installation with the shell "sh" command or with Homebrew

curl -sSfL https://raw.githubusercontent.com/manifest-cyber/cli/main/install.sh | sh -s

brew install manifest-cyber/tap/manifest-cli

Linux: Linux users can also use the recommended installation with the shell "sh" command, or via apt/yum

curl -sSfL https://raw.githubusercontent.com/manifest-cyber/cli/main/install.sh | sh -s

echo "deb [trusted=yes] https://repo.fury.io/manifest/ /" > /etc/apt/sources.list.d/fury.list
sudo apt update
sudo apt install manifest-cli

echo '[fury]
name=Manifest Cyber
baseurl=https://repo.fury.io/manifest/
enabled=1
gpgcheck=0' | sudo tee /etc/yum.repos.d/manifest-cyber.repo
sudo yum install manifest-cli

Windows: no WSL, Git Bash, or other POSIX shell required. Use Scoop (requires Scoop itself to be installed first), or download the binary directly from PowerShell or Command Prompt
```
scoop bucket add manifest-cli https://github.com/manifest-cyber/scoop-bucket.git
scoop install manifest-cli
```
```
curl.exe -sSfLo manifest-cli.zip https://github.com/manifest-cyber/cli/releases/latest/download/manifest-cli_windows_x86_64.zip
tar -xf manifest-cli.zip
```
This extracts manifest-cli.exe into the current folder. Move it to a folder on your PATH, or add the folder to your PATH.
- You can find the Windows file to download on the releases page

Pick your generator
1. We recommend syft , trivy, or csbom (Manifest's native C/C++ SBOM generator). Each has strengths and weaknesses.
  1. Containers: use syft or trivy
  2. Source code: use syft or cdxgen
  3. C and C++: use csbom (Manifest's native C/C++ SBOM generator)
2. Keep in mind that each generator works differently. Reach out to your Manifest support rep for specific questions about picking the best generator for your target and use case.
Install the generator
```
manifest-cli install -g syft
```
On Windows, add --native so the generator installs without WSL or Bash. It installs next to manifest-cli.exe, which is already on your PATH:
```
manifest-cli install -g syft --native
```

Run the generator

// Basic
manifest-cli sbom <path/to/repo>

// Specify some options: -f for output filename, -n for SBOM name in Manifest Platform
manifest-cli sbom -f bom.json -n "SBOM Name from docs" <path/to/repo>

// Specify the generator, making sure it's installed. Container example
manifest-cli sbom -g trivy alpine:latest

// Add custom Name and Version metadata to the output SBOM
manifest-cli sbom -n=my-product --version=1.0.1 -o cyclonedx-json <path/to/repo>

// Auto-publish SBOM to Manifest platform
manifest-cli sbom --publish -k=<MANIFEST_API_KEY> <path/to/repo>

On Windows, if you installed the generator with --native, add --native to your sbom commands too, for example:

manifest-cli sbom --native <path/to/repo>

If you get an error where the manifest-cli command is not running, you might need to follow these instructions for Mac/Linux or these instructions for Windows to fix the location of where the tool is called from

Upload or view SBOM analysis

If you used the --publishparameter or command on the cli, the SBOM will be automatically sent to the platform for analysis. Open app.manifestcyber.com and look for the most recently uploaded Asset on the Assets List page or on the Uploads page.

You can also manually drag-and-drop it into the Manifest Platform via the Uploads page.

Example: Github App

The Github App is the fastest way to generate SBOMs in Manifest, and it doesn't requiring any code or command lines. It relies on Github's native SBOM generation functionality.

Follow the steps in the Using the Github App guide to set it up, and you're good to go!

Congrats!

Now you've generated and uploaded your first SBOM!