Using dependency-management-data with GitLab's Pipeline-specific CycloneDX SBOM exports

Featured image for sharing metadata for article

Earlier today I spotted an exciting result in the changelog for the release of GitLab 16.4, which happened last Friday, which added Pipeline-specific CycloneDX SBOM exports

When I was working on dependency-management-data's expanded offerings other than the original Renovate datasource, I had investigated GitLab's existing Dependency List API but did not proceed with it because the structure of the data wasn't ideal.

However, with the GitLab 16.4 release, the availability to use CycloneDX SBOMs is really awesome, because using an existing well-supported standard for this means it's already supported in dependency-management-data as part of a release earlier this month πŸŽ‰

So how do we take advantage of this? We can follow the documentation (which notes that this is an experimental feature!) and run:

$ export GITLAB_TOKEN=glpat...
$ curl --request POST --header "PRIVATE-TOKEN: $GITLAB_TOKEN" "" --data "export_type=sbom"
  "download": "",
  "has_finished": false,
  "id": 1008825,
  "self": ""

Once processed, we can then download the resulting SBOM, and import it into dependency-management-data with:

dmd import sbom --db dmd.db sbom.json --platform gitlab --organisation --repo gitlab-example-security-reports

And it's that simple! We now have all the data available in dependency-management-data πŸ‘

You can see the data that's available from this SBOM in the example app.

Written by Jamie Tanna's profile image Jamie Tanna on , and last updated on .

Content for this article is shared under the terms of the Creative Commons Attribution Non Commercial Share Alike 4.0 International, and code is shared under the Apache License 2.0.

#dependency-management-data #sbom #gitlab.

This post was filed under articles.

Interactions with this post

Interactions with this post

Below you can find the interactions that this page has had using WebMention.

Have you written a response to this post? Let me know the URL:

Do you not have a website set up with WebMention capabilities? You can use Comment Parade.