SPDX Bom generate

Certified Kubernetes Security Specialist
#1

I have seeing one question that identify image from deployment which has vulnerable curl and I ahve find two images from deployments out of 3 images. And asked create an SBOM SPDX for the container’s image and save to ~/bugged.spdx.

I have find two images below command
k exec -n -c – apk info | grep curl

but bom generate and save it to the spdx file for two images what is the command?

i have simply run bom generate -i -i --format json --output bugged.spdx
please provide the detail explanation is it correct or not?

#2

To ensure the output of apk info is piped to curl inside the container, a safe command would be:
kubectl exec -n <namespace> -c <container> my-pod -- sh -c 'apk info --verbose | grep curl'

And to generate an SPDX SBOM and save it to a file
bom generate -i <image-name/image-archive> --format json --output <output-file-name>

You can refer to the official bom docs for more info.