Provide CycloneDX SBOM as an alternative to SPDX SBOM

[mawl]

Hi there,

currently Harbor generates a trivy SPDX SBOM: https://goharbor.io/docs/edge/administration/sbom-integration/

We would prefer CycloneDX over SPDX json as it is more widely adopted.

In our special case, we would like to sync SBOMs generated in Harbor to Dependency-Track.

Trivy is already capable of generating a CycloneDX SBOM from docker images, so I hope a neat solution is not too complex to implement.

BTW: is there already an API endpoint for downloading SBOMs?

Thanks for your efforts in advance.

[bupd]

BTW: is there already an API endpoint for downloading SBOMs?

I think there is no direct API endpoint for downloading SBOMs. but you can download it by using

curl -X GET https://<your-harbor-domain>/api/v2.0/projects/<project-name>/repositories/<repo-name>/artifacts/<artifact-digest>/additions/sbom