csspin_tooling.sbomqs

The csspin_tooling.sbomqs plugin gates an SBOM against a quality policy. It downloads and manages sbomqs and exposes a single task that runs sbomqs policy against the project’s CycloneDX SBOM. The task exits non-zero on policy violations, so it can be used as a blocking gate e.g., in CI.

How to set up the `csspin_tooling.sbomqs` plugin?

For using the csspin_tooling.sbomqs plugin, a project’s spinfile.yaml must at least contain the following configuration.

Minimal configuration of spinfile.yaml to use csspin_tooling.sbomqs

spin:
    project_name: mypkg
plugin_packages:
    - csspin-tooling
plugins:
    - csspin_tooling.sbomqs

Provisioning downloads sbomqs into the spin data directory and makes it available for all subsequent tasks:

Provisioning the project including sbomqs

spin provision

How to gate an SBOM?

The sbomqs policy task gates the SBOM configured via sbomqs.input_file (default <project_name>.cdx.json) against the policy. It is a standalone command group, invoked after spin sbom has produced the SBOM:

Gate the SBOM

spin sbomqs policy

When the SBOM violates the policy, the task terminates with a non-zero exit code.

How to use a custom policy?

When sbomqs.policy_file is unset, the plugin uses the policy bundled with the package. The default blacklists copyleft licenses incompatible with commercial distribution (GPL-.* including LGPL and AGPL, EUPL-.*, and the CC-BY-SA/CC-BY-NC/CC-BY-ND family) and requires every component to carry a name, version, and license.

Set sbomqs.policy_file to a local path to replace the bundled default entirely:

Using a custom policy

spin -p sbomqs.policy_file=/path/to/policy.yaml sbomqs policy