Trivy EP14: Generate SBOM with Trivy | CycloneDX & SPDX Explained + Demo

1. Introduction to Software Bill of Materials (SBOM) in DevSecOps

An SBOM (Software Bill of Materials) acts as an exhaustive ingredient list for container images and applications. In modern DevSecOps pipelines, generating an SBOM is crucial for tracking software supply chain security, identifying third-party components, and auditing licenses.

• Purpose of an SBOM: Provides granular visibility into every package, library, dependency, and version bundled inside a container image or artifact.
• Supply Chain Visibility: Helps organizations instantly determine if their applications contain newly disclosed vulnerabilities (such as zero-days in Log4j or OpenSSL) without having to manually run deep internal inspections.
• Standardization: Major industry formats standardize how SBOM data is structured, parsed, and shared across teams.

2. Core Mental Model: The Ingredient List Analogy

Think of an SBOM like the detailed nutritional and ingredient label on a packaged food product.

• Without an SBOM: You are consuming or deploying a black-box binary; if a toxic ingredient (vulnerability) is discovered inside, you have no easy way of knowing if it exists in your inventory.
• With an SBOM: You have a precise, machine-readable manifest listing every single upstream dependency, allowing automated scanners and security teams to instantly query vulnerabilities.

3. SPDX vs. CycloneDX: Format Comparison

Trivy supports multiple standard SBOM formats. While both formats document dependencies, their primary focus areas differ significantly.

4. Generating an SPDX SBOM with Trivy

To generate an SPDX-compliant SBOM for a target container image (e.g., alpine:3.15), Trivy uses the image scanning command coupled with the appropriate --format and --output flags.

Command Execution

Run the following command in your terminal to generate an SPDX JSON report:

trivy image --format spdx-json --output result.json alpine:3.15

Understanding the Command Structure

5. Visualizing and Interpreting SPDX Reports

Because raw SPDX JSON output is dense and difficult for humans to parse directly via cat result.json, specialized visualizers are utilized.

Visualization Workflow

1. Generate Raw JSON: Run Trivy to export result.json.
2. Access Visualizer: Open an SPDX-compatible viewer (such as the Rancher SPDX Viewer tool).
3. Import Data: Upload or drag-and-drop result.json into the web interface.
4. Analyze Structure: Inspect metadata, licenses, and dependency hierarchies.

Reading SPDX Elements & Hierarchies

• SPDX Version: Displays specification compliance (e.g., SPDX Version: 2.3).
• Document Namespace & Creator: Identifies the generating tool (aquasecurity/trivy) and organizational context.
• Package Inventories: Lists components embedded in the Alpine image (e.g., alpine-baselayout, busybox, musl).
• Relationship Mapping (dependsOn):
  • Establishes parent-child relationships (e.g., Package A dependsOn Package B).
  • Security Implication: If Package B harbors a critical vulnerability, it creates an indirect security risk for Package A.

6. Generating a CycloneDX SBOM with Trivy

Switching from SPDX to CycloneDX requires changing the format flag while maintaining the core Trivy scanning syntax.

Command Execution

Run the following command in your terminal to generate a CycloneDX JSON report:

trivy image --format cyclonedx --output result.json alpine:3.15

Note: Always verify your spelling for format arguments (cyclonedx vs spdx-json). Typos will cause Trivy to throw an invalid format configuration error.

7. Visualizing and Filtering CycloneDX Reports

Similar to SPDX, CycloneDX JSON outputs are best reviewed using specialized dashboards.

Visualization Workflow

1. Generate CycloneDX JSON: Export output using --format cyclonedx.
2. Access Visualizer: Navigate to an OWASP CycloneDX viewer (such as Sunshine SBOM Viewer).
3. Import Data: Select and upload result.json.
4. Inspect Components: Review component types (Application vs. Container), SHA-1 hashes, serial numbers, and base layers scanned.

Filtering by Severity in CycloneDX

Advanced viewers allow security engineers to filter large dependency lists down to actionable risks:

• Severity Filtering: Select specific severity filters (e.g., restricting views to Critical or High).
• Interactive Triage: Instantly isolate vulnerable base layers without getting overwhelmed by harmless, low-severity packages.
• Reporting & Export: Export filtered reports into CSV or Excel formats to share remediation task lists with development and patch management teams.

8. Summary and Key Takeaways

• SBOM Definition: An SBOM serves as an immutable ingredient list for applications and container images, essential for modern DevSecOps supply chain security.
• Standardization Options: Trivy natively supports major SBOM standards, primarily SPDX (focused on licensing and legal compliance) and CycloneDX (optimized for vulnerability management and application components).
• Consistent Command Syntax: Generating an SBOM requires appending format flags (--format spdx-json or --format cyclonedx) and output parameters (--output result.json) to standard Trivy image scan commands.
• Human-Readable Visualization: Raw JSON outputs are difficult to parse manually; tools like Rancher SPDX Viewer and Sunshine SBOM Viewer translate raw data into intuitive graphical dashboards.
• Dependency Hierarchy Analysis: Relationship mapping (dependsOn) helps security engineers trace indirect vulnerabilities across nested package structures.
• Actionable Filtering: CycloneDX viewers allow teams to filter components by critical severities, making large-scale vulnerability management efficient.
• Cross-Team Collaboration: Processed SBOM reports can be exported to CSV or Excel formats to facilitate clear communication between security auditors, developers, and patch operations teams.