Create or Update a Project by Importing an SBOM File

Overview

Mend.io enables you to import an SBOM file, to update an existing project in the application or create a new one.

An SBOM file traditionally specifies the libraries, code packages, and other third-party components that are used in your project.

Once imported, licensing and vulnerability data will be associated with your project’s dependencies, like any other project scanned into the application. Projects created or updated via SBOM imports will be regularly monitored for new vulnerabilities and updates.

Prerequisites

Mend.io allows you to import SBOM files exported by the following tools:

• Mend.io’s SBOM Export Report

• CycloneDX cdxgen

• Trivy

The supported SBOM standards are CycloneDX (versions 1.4, 1.5) and SPDX (versions 2.2, 2.3).

The supported formats are JSON and XML.

Getting it done

Create a new Project by Uploading an SBOM File via the Add Project Wizard

To create a new project out of an existing SBOM file, you will need to upload the SBOM file to the product in which you would like the new project created.

1. Navigate to the Products menu and select the product in which you would like to create the new project:

   

2. On the product page, click the “Add Project” button:

   

3. A. In the Project Details wizard, specify a Project Name and Description.
   B. Check the “Import SBOM” box, to reveal the option to upload an SBOM file.
   C. Click “Choose File” to browse your file system and select the desired SBOM file which meets the required specifications.

   

4. Click the “Create” button () located at the bottom-right corner of the wizard.

At this stage, you may see a “Background process in progress” message at the top of the project page, indicating that the new project is being set up.

Update an Existing Project by Uploading an SBOM File via the Project Administration Screen

To import an SBOM report, you will need to upload a previously generated SBOM report file to the application via the Project Administration page:

1. Find your project in the Projects menu and click it:
   

   

   Alternatively, you can navigate to the relevant product and locate the project under “Project Summary”.

2. Clicking the cogwheel button () at the far right will take you to the Project Administration page.

3. Click “Update Project”:
   

   

4. In the Update Project window, click “Choose File” to browse your file system for the SBOM file. Click “Update” to upload the selected file.
   

   

Note: The SBOM import will override the project’s existing inventory.

Compare your SBOMs

A common use case following the SBOM import process is to compare projects, e.g., comparing different versions of a project represented through SBOM files. This comparison helps in identifying changes in dependencies, vulnerabilities, and licensing information across project versions.

Mend.io recommends using the existing “Project Comparison” capability, to compare different projects' inventories and licenses.

On the project page, click the “Compare to another Project” button:

That will take you to the Project Comparison screen, allowing you to select the two projects you wish to compare.

Note that the Licensing Occurrences table on the right lists license differences, which may be handy, for example in case you wish to identify unwanted licenses added/removed in the new version of your project:

Limitations

1. Source libraries in SBOM Export files generated by Mend.io are ignored.

2. Keywords support limitations:

   • For SPDX, Mend.io supports the properties below:

     CODE

     "DEPENDS_ON", 
     "DYNAMIC_LINK", 
     "STATIC_LINK", 
     "CONTAINS", 
     "DESCRIBE"

   • For CycloneDX, Mend.io supports the “dependsOn” property.
     Example:

     CODE

     "ref": "pkg:maven/com.google.apis/google-api-services-ml@v1-rev20210212-1.31.0?type=jar", 
     "dependsOn": [ "pkg:maven/com.google.api-client/google-api-client@1.31.1?type=jar" ]