Adding additional metadata to an SBOM

[idunbarh]

I'm using Cataloging Artifacts to generate SBOMs for artifacts. I'd like add additional metadata to the cyclonedx sboms like author, license, etc ...

Whats the best way to run multiple commands within the artifact cataloging?

Typically I run ...

sboms:
  - id: generate-cyclonedx
    artifacts: archive
    documents: [$artifact.cdx.json]
    cmd: syft
    args: [scan, $artifact, --output, cyclonedx-json=$document]

and I'd like to include a command like ...

jq -s '.[0] * .[1]' $document sbom_metadata/metadata.cdx.json > combined.cdx.json

... to merge the syft generated sbom with another containing the custom metadata.

Is the best solution to create a shell script and call that instead of syft?

[caarlos0]

yeah, probably the shell combining both tools is the best way