Upload SBOM via API using PUT request

[Trakeur]

Hi everyone,

I'm trying to send my SBOM to the Dependency track API but I have the following error :
["message":"The BOM must be Base64 encoded","messageTemplate":"The BOM must be Base64 encoded"]

Yet I try to send my SBOM encoded in base64 with the following curl request :
curl -X 'PUT' -d '{"project":"project_uuid","bom":"$(base64 ./sbom.json)"}' 'http://localhost:8081/api/v1/bom' -H 'accept: application/json' -H 'X-Api-Key: API_KEY' -H 'Content-Type: application/json'

Does anyone know why it consider that my SBOM is not encoded ?

Thank you.

[nscuro]

The shell will not interpret $() within single-quoted strings.

At the moment, what the API server receives, is literally the string $(base64 ./sbom.json).

This should work:

curl -X 'PUT' \
    -d '{"project":"project_uuid","bom":'"\"$(base64 ./sbom.json)\""'}' \
    'http://localhost:8081/api/v1/bom' \
    -H 'accept: application/json' \
    -H 'X-Api-Key: API_KEY' \
    -H 'Content-Type: application/json'

[Trakeur]

Thank you,
though I have a new error:
Illegal unquoted character ((CTRL-CHAR, code 10)): has to be escaped using backslash to be included in string value at [Source: (org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream); line: 1, column: 135] (through reference chain: org.dependencytrack.resources.v1.vo.BomSubmitRequest["bom"])

And I don't figure out why

[nscuro]

Try sending your request to https://httpbin.org/anything or use similar services like Pipedream to see what you're actually sending.

[Trakeur]

The problem was the line feeds in the generated base64 file. You must precise it in the base64 command. So the following command work for me :
curl -X 'PUT' \ -d '{"project":"PROJECT_UUID","bom":'"\"$(base64 --wrap=0 ./sbom.json)\""'}' \ 'http://localhost:8081/api/v1/bom' \ -H 'accept: application/json' \ -H 'X-Api-Key: API_KEY' \ -H 'Content-Type: application/json'
Thank you @nscuro !