Generating an SBOM for Go
The step below writes a CycloneDX JSON software bill of materials (SBOM) in your own pipeline. The CRA Desk scan reads that file and turns it into a Cyber Resilience Act (CRA) readiness report - it never generates one for you.
Run in CI:
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest cyclonedx-gomod mod -json -output sbom.json
- Produces:
- sbom.json
- Format:
- CycloneDX JSON
What the generator actually reads
The module graph is a build-time answer rather than a link-time one: a module required by one of your dependencies is in it even when no package from it is ever imported. The file is therefore a superset of what ships - the safe direction for a readiness report and the reason a component count here will not match a binary's symbol table.
Versions and package URLs
Modules come out as pkg:golang purls carrying a semantic version or a pseudo-version, matching OSV's Go advisories. Two things are absent by design: the standard library, which is not a dependency in go.mod and anything vendored outside the module system - so a vulnerability in vendored C code is not something this file can report.
The whole CI job
GitHub Actions
- uses: actions/checkout@v4
- run: go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- run: cyclonedx-gomod mod -json -output sbom.json
- uses: mmalinowski/cradesk-action@v1
with:
sbom-path: sbom.jsonGitLab CI/CD
generate-sbom:
script:
- go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- cyclonedx-gomod mod -json -output sbom.json
include:
- component: gitlab.com/cradesk/scan/readiness@1
inputs:
sbom_path: sbom.jsonOnly the first step changes with your stack - the CRA Desk step after it is identical everywhere.
What goes wrong here
cyclonedx-gomod mod reads go.mod, which lists more than a binary actually links. Use cyclonedx-gomod app for what ships, at the cost of building it first.
Repositories with more than one thing in them
One go.mod is one module graph. A repository holding several modules needs a run per module and the results are separate inventories rather than parts of one: the scan reads a single file, so generate for the module that corresponds to the product you ship instead of merging them by hand.
What CRA Desk does with the result
Components from this build carry pkg:golang package URLs, which the watch matches against OSV's Go advisories when the SBOM arrives and again as new advisories land. Matching runs on every plan; e-mail alerts and the full match list are what a paid plan adds.
A generator that runs is not the same as coverage. Components with no purl, no version, or from an ecosystem outside the ones we watch are counted as gaps in every report rather than reported as clean.