DemaConsulting.SpdxTool 0.1.0-alpha.1

SPDX Tool

Dotnet tool for manipulating SPDX SBOM files

Installation

The following will add SpdxTool to a Dotnet tool manifest file:

dotnet new tool-manifest # if you are setting up this repo
dotnet tool install --local DemaConsulting.SpdxTool

The tool can then be executed by:

dotnet spdx-tool <arguments>

Usage

The following shows the command-line usage of SpdxTool:

Usage: spdx-tool [options] <command> [arguments]

Options:
  -h, --help                             Show this help message and exit
  -v, --version                          Show version information and exit

Commands:
  help <command>                         Display extended help about a command
  run-workflow <workflow.yaml>           Runs the workflow file
  to-markdown <spdx.yaml> <out.md>       Create Markdown summary for SPDX document
  rename-id <arguments>                  Rename an element ID in an SPDX document.
  copy-package <arguments>               Copy package information from one SPDX document to another.

Workflow YAML Files

The SpdxTool can be driven using workflow yaml files of the following format:

steps:
- command: <command-name>
  <arguments mapping>

- command: <command-name>
  <arguments mapping>

YAML Commands

The following are the supported commands and their formats:

steps:

  # Run a separate workflow file
- command: run-workflow
  file: other-workflow-file.yaml

  # Create a summary markdown from the specified SPDX document
- command: to-markdown
  spdx: input.spdx.json
  markdown: output.md

  # Rename the SPDX-ID of an element in an SPDX document
- command: rename-id
  spdx: <spdx.json>
  old: <old-id>
  new: <new-id>

  # Copy a package from one SPDX document to another SPDX document  
- command: copy-package
  from: <from.spdx.json>
  to: <to.spdx.json>
  package: <package>
  relationship: <relationship>
  element: <element>