CRA SBOM CLI

What it is

cra-sbom-cli (command cra-sbom-report), an offline Python CLI that bundles the CRA SBOM Platform's server-side content checks. The summary covers what it evaluates; below are the operational details that decide whether it fits your pipeline.

What to do

The exit code is the biggest trap: it is 0 whenever the tool ran, regardless of PASS/FAIL. The verdict lives only in the JSON output. To gate CI on the verdict you must emit JSON and parse it:

cra-sbom-report sbom.json --json result.json
verdict=$(jq -r '.verdict' result.json)
[[ "$verdict" == "PASS" ]] || exit 1

For CI, run offline to skip grype's vuln-DB pull, and auto-answer installer prompts:

cra-sbom-report sbom.spdx.json --no-enrich
./install.sh --yes

Hash algorithm/strength checks are not in the default run — they require --enhanced. Install without a symlink or into a venv via ./install.sh --no-symlink or pip install ..

Preconditions / Affected

• Python 3.10+ and reportlab are the only hard dependencies; grype, sbomqs, and jq are optional and prompted-for (never installed silently).
• Input must be CycloneDX (1.5+, JSON/XML) or SPDX 2.3 (JSON/tag-value). SPDX 3.0 is detected and hard-fails — re-export as SPDX 2.3 or CycloneDX 1.5+.

Caveats

• PASS ≠ CRA-compliant — automated checks only cover SBOM content; conformity also needs the manually-attached evidence catalogued in the PDF.
• No evidence-attachment state offline. The platform's database-backed attachments don't exist here; the PDF shows the catalogue with no attached-status overlay.
• No SBOM signing, no webhook fan-out.
• Drift risk: the compliance logic is a manual copy out of the platform backend (backend/app/services/), with cross-imports rewritten to relative paths. Updating the platform does not update this CLI — the two are separate codepaths that must be kept in sync, so a CLI verdict may lag the platform's current checks.

flowchart TD
    A[cra-sbom-report run] --> B{Tool executed?}
    B -->|error| C[exit non-zero]
    B -->|yes| D[exit 0 always]
    D --> E[verdict in JSON only]
    E --> F{parse .verdict}
    F -->|PASS| G[still not CRA-compliant<br/>manual evidence required]
    F -->|FAIL| H[fail the build]