SBOM Lab

Purpose

This repository is a personal SBOM lab. It currently uses Python package dependency files as the sample input, with room to add other ecosystems later. It demonstrates:

1. CycloneDX SBOM generation from pinned Python requirements files.
2. Manual and API upload of SBOMs into OWASP Dependency-Track.
3. Dependency-Track component inventory review.
4. Python vulnerability evidence using pip-audit.
5. Evidence retention for screenshots, SBOMs, and audit output.

This is a lab. It is not a production deployment and it is not a compliance statement.

Current sample ecosystem: Python / PyPI. Future samples can be added under samples/ for other ecosystems such as .NET / NuGet.

Why both Dependency-Track and pip-audit are included

Dependency-Track is used here for SBOM import, component inventory, project/version tracking, and future workflow practice.

During local testing, Dependency-Track imported the Python components successfully but showed zero vulnerabilities. That can happen when the active Dependency-Track vulnerability datasources/analyzers do not match PyPI Package URLs in the expected way.

For this lab, pip-audit is included as the Python-specific vulnerability proof step. It scans the same requirements-before.txt and requirements-after.txt files and writes JSON audit evidence under evidence/audit/.

Repository structure

.
├── .github/workflows/sbom-scan.yml
├── docker-compose.yml
├── requirements-tools.txt
├── .env.example
├── .gitignore
├── docs/
├── evidence/
├── pipelines/
├── runbooks/
├── samples/python/
│   ├── requirements-before.txt
│   └── requirements-after.txt
└── scripts/

Local prerequisites

• Windows PowerShell 5.1 or PowerShell 7+
• Docker Desktop with Docker Compose v2
• Python 3.10+ available as python
• Internet access for Docker image pulls, Python package installation, and vulnerability datasource calls

If PowerShell blocks scripts for this session:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

Start Dependency-Track

Copy-Item .env.example .env
.\scripts\Start-Lab.ps1

Open:

http://localhost:8080

API:

http://localhost:8081

Default first Dependency-Track login is normally:

admin / admin

Dependency-Track normally forces a password change after first login.

Generate SBOM and vulnerability evidence

Run:

.\scripts\Invoke-LabEvidence.ps1

This creates:

evidence/sbom/python-before.cdx.json
evidence/sbom/python-after.cdx.json
evidence/audit/python-before-pip-audit.json
evidence/audit/python-after-pip-audit.json

pip-audit exits with code 1 when vulnerabilities are found. The lab script treats that as expected evidence, not as a script failure.

Upload SBOMs manually first

In Dependency-Track:

1. Create project: python-requirements-lab
2. Create/upload version: before
3. Upload: evidence/sbom/python-before.cdx.json
4. Create/upload version: after
5. Upload: evidence/sbom/python-after.cdx.json

Review:

Projects → python-requirements-lab → Components
Projects → python-requirements-lab → Vulnerabilities

If Dependency-Track imports components but shows zero vulnerabilities, continue using the pip-audit output as the Python vulnerability evidence for this lab. See docs/dependency-track-zero-vulnerabilities.md.

API upload after manual validation

Create a Dependency-Track API key with BOM upload permission, then run:

.\scripts\Publish-SbomToDependencyTrack.ps1 `
  -BomFile .\evidence\sbom\python-before.cdx.json `
  -ProjectName "python-requirements-lab" `
  -ProjectVersion "before" `
  -ApiKey "PASTE_API_KEY_HERE"

Stop the lab

.\scripts\Stop-Lab.ps1

To reset all local Dependency-Track data:

.\scripts\Stop-Lab.ps1 -Reset

GitHub safety

This repository is safe for a personal public portfolio only because it uses artificial Python sample dependencies. Do not commit company SBOMs, customer names, private package names, real API keys, internal screenshots, or production vulnerability evidence.