SBOM Merging Overview
Elements of two or more CycloneDX SBOMs can be merged using the hopctl merge
subcommand.
This subcommand dynamically updates Hoppr's CycloneDX models with a custom hash method.
This custom hash method uses select model types to define equality rules, and unique mapping/lookup
is added for each model type. This capability performs a "deep merge" of components and their metadata
providing a comprehensive merged SBOM. It can also be used to follow external references of type bom
and expand those references into a single bom. This includes flattening nested components, and properly
modeling them with depends_on
.
The intent of hopctl merge is to dynamically update hoppr-cyclonedx-models with a custom __hash__
method.
- Creates CycloneDXBaseModel class as base class for all hoppr-cyclonedx-models
- Custom
__hash__
method for select model types to define rules for equality - Adds unique ID mapping/lookup for each model type
- Adds
find
method to return a previously loaded object of the subclass model type - Adds
merge
method with generic logic on all CycloneDX models to merge an object of the same type into itself
Hopctl Merge subcommands
Hopctl Merge offers several customization options.
Usage: hopctl merge [OPTIONS]
Merge all properties of two or more SBOM files
| Options | Flag | Type | Description |
| ------------- | ---- | --------- | -------------------------------------------------------------------------- |
| --manifest | -m | FILE | Manifest file containing SBOMs to merge |
| --sbom | -s | FILE | SBOM file to merge (can be specified multiple times) |
| --sbom-dir | -d | DIRECTORY | Directory containing SBOM files to merge (can be specified multiple times) |
| --sbom-url | -u | URL | URL of SBOM to merge (can be specified multiple times) |
| --output-file | -o | FILE | Path to output file [default: hopctl-merge-YYMMDD-HHMMSS.json] |
| --deep-merge | | | Resolve and expand externalReferences in-place |
| --flatten | | | Flatten nested components into single unified list |
| --help | -h | | Show this message and exit |
Examples
# Merges example and example 2
hopctl merge --sbom sbom.example.json --sbom sbom.example2.json
# Merges all sboms in the sboms directory
hopctl merge --sbom-dir ../sboms
# Applies deep merge and directs it to an outfile named hopctl-merge-example.json
hopctl merge --sbom sbom.example.json --sbom sbom.example2.json --deep-merge --output-file ../merged-sboms/hopctl-merge-example.json