Create SBOMs in SPDX and CycloneDX format for a local repository

trivy-sbom-local

#!/usr/bin/env bash
set -euo pipefail

CACHE=$(realpath ~/.cache/trivy)

if [ $# -eq 0 ]; then
    echo "Please specify a local repository to scan."
    exit 1
else
    REPO=$(realpath $1)
    docker run --rm -it --user "$(id -u):$(id -g)" -v "$CACHE:/.cache/trivy:rw" -v "$REPO:/code:rw" aquasec/trivy fs --format spdx-json --output /code/sbom-spdx.json /code
    docker run --rm -it --user "$(id -u):$(id -g)" -v "$CACHE:/.cache/trivy:rw" -v "$REPO:/code:rw" aquasec/trivy fs --format cyclonedx --output /code/sbom-cyclonedx.json /code
fi

trivy-security-local

#!/usr/bin/env bash
set -euo pipefail

if [ $# -eq 0 ]; then
    echo "Please specify a local repository to scan."
    exit 1
else
    REPO=$(realpath $1)
    docker run --rm -it -v "$REPO:/code:ro" aquasec/trivy fs /code
fi