Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Using the CLI

Use the CLI to generate SBOMs for source code, package files, and container images. SBOMs appear on the Projects page after upload. Generation time varies from a few seconds to several hours, depending on project size. The CLI collects metadata at n levels of depth, covering each component, its direct dependencies, and its transitive dependencies.

Ensure the output folder has at least 100 GB of free space.

Depending on the size of the source, packages, and dependencies discovered, the CLI may take a significant amount of time to complete. Run the CLI inside a screen or tmux session to prevent an interrupted user session from breaking the CLI run.

The CLI creates a JSON log file named veelocal.log in the current directory. To also capture CLI output, redirect it to a separate log file:

./veecli collect --inputfile input.json --output output 2>&1 | tee output.log

This page covers common collection and upload workflows across local files, Docker, Docker Hub, Amazon ECR, and Azure Container Registry.

Generate an SBOM From an Input JSON

Provide an input file and an output directory.

The output directory is used for checkout, downloads, extraction, and artifacts.

cd veecli
./veecli collect --inputfile input.json --output output

Example output:

2022-07-07T14:18:15.584+0300 info Starting data collection
2022-07-07T14:18:16.924+0300 info SBOM created for project acme and version 2.10.5 with project id - ***, sbom id - SPDXRef-DOCUMENT-vdna_*****, sbom job id - SPDXRef-DOCUMENT-vdna_****
...
2022-07-07T14:18:16.934+0300 info Successfully uploaded archive of collection artifacts – output/acme/acme-SPDXRef-DOCUMENT-vdna_******.tar.gz
2022-07-07T14:18:16.934+0300 info Successfully completed data collection

Keep at least 100 GB free in the output directory.

Large scans can run for a while.

Use screen or tmux for long-running jobs.

The CLI also writes a JSON log file named veelocal.log in the current directory.

A common pattern is:

./veecli collect --inputfile input.json --outpath output 2>&1 | tee output.log

Generating SBOM From Source Code

Run the CLI using the following command. The CLI decomposes source code locally and uploads only the metadata to the Lineaje backend. Metadata includes package information (name, version, checksum) and source code information (URL, version, commits, timezone).

./veecli collect --inputfile <input.json> --output <output_path>

Open Source examples of input.json

Maven project
{
  "project": "maven project",
  "version": "0.9.125",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/cloudera/cdp-sdk-java",
        "matchingref": "0.9.125",
        "type": "github"
      }
    }
  ]
}

Gradle project
{
  "project": "gradle project",
  "version": "parent-4.12.0",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/square/okhttp",
        "matchingref": "parent-4.12.0",
        "type": "github"
      }
    }
  ]
}

Python project
{
  "project": "pypi project",
  "version": "v1.9.2",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/aio-libs/yarl",
        "matchingref": "v1.9.2",
        "type": "github"
      }
    }
  ]
}

go-lang project
{
  "project": "golang project",
  "version": "v0.10.0",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/charmbracelet/lipgloss.git",
        "matchingref": "v0.10.0",
        "type": "github"
      }
    }
  ]
}

NPM project
{
  "project": "npm project",
  "version": "v8.4.0",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/bevry/cson",
        "type": "github",
        "matchingref": "v8.4.0"
      }
    }
  ]
}

Rust project
{
  "project": "rust project",
  "version": "v0.2.7",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/redcanaryco/oxidebpf",
        "matchingref": "v0.2.7",
        "type": "github"
      }
    }
  ]
}

Ruby project
{
  "project": "ruby project",
  "version": "v3.4.2",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/rails/sprockets-rails",
        "type": "github",
        "matchingref": "v3.4.2"
      }
    }
  ]
}

Nuget project
{
  "schema": "1.0",
  "project": "sanity project",
  "version": "13.0.1",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://github.com/JamesNK/Newtonsoft.Json",
        "type": "github",
        "matchingref": "13.0.1"
      }
    }
  ]
}

PHP project
{ 
"project": "php project", 
"version": "1.0.0", 
"exclude_test_dependency": true, 
"inputtype": "github", 
"inputs": [ 
   { 
     "src_info": { 
       "srcurl": "https://github.com/akaunting/akaunting", 
       "matchingref": "master", 
       "type": "github" 
     } 
   } 
 ] 
}

Private source example of input.json

{
  "project": "<private-repo-name>",
  "version": "<branch/tag/commit-id>",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "<github/gitlab/bitbucket/git>",
  "inputs": [
    {
      "src_info": {
        "srcurl": "<private repo url>",
        "matchingref": "<branch/tag/commit-id>",
        "type": "<github/gitlab/bitbucket/git>"
      }
    }
  ],
  "repository_access_configs": [
    {
      "path": "<private repo url>",
      "type": "<github/gitlab/bitbucket/git>",
      "user_name": "<user-name>",
      "token": "<auth-token>"
    }
  ]
}

A sample bitbucket private repo
{
  "project": "curl-private-1",
  "version": "main",
  "exclude_test_dependency": true,
  "exclude_optional_dependency": true,
  "use_native_tools": true,
  "inputtype": "github",
  "inputs": [
    {
      "src_info": {
        "srcurl": "https://bitbucket.org/1234/curl-private",
        "matchingref": "main",
        "type": "bitbucket"
      }
    }
  ],
  "repository_access_configs": [
    {
      "path": "https://bitbucket.org/1234/curl-private",
      "type": "bitbucket",
      "user_name": "x-token-auth",
      "token": "1234567890"
    }
  ]
}
Generate an SBOM From Files in a Directory

Use upload when you want to scan a directory and send the result to the backend.

All fields are required.

cd veecli
./veecli upload --input dir --type folder --name my-project --version 1.0
Generate an SBOM From WAR or EAR Files in a Directory

Use collect when the directory contains WAR or EAR packages.

You must provide the project name and version.

cd veecli
./veecli collect --input-dir package-dir --output output --project my-project --version 1.0
Generate an SBOM From Local Docker

The CLI supports two approaches:

  1. Upload the image manifest and generate the SBOM in the backend.

  2. Generate the SBOM locally and upload the collected results.

Backend generation is faster.

Local generation uses more disk and CPU.

Generate an SBOM From Public Docker Hub

Generate an SBOM From Private Docker Hub

Generate an SBOM From Private Amazon ECR

Before you scan a private ECR image:

  1. Create an IAM role with the required permissions.

  2. Install and configure the AWS CLI.

  3. Run docker login with an ECR token.

Grant at least these AWS permissions:

  • AmazonEC2ContainerRegistryReadOnly

  • AmazonElasticContainerRegistryPublicReadOnly

The CLI supports Docker Community Engine.

Docker installed through Ubuntu snap is not supported.

Generate an SBOM From Public Amazon ECR

Generate an SBOM From Private Azure Container Registry

Private ACR access requires registry access keys.

Set the username and password before running the scan.

Generate an SBOM From Public Azure Container Registry

Generate an SBOM From An Image

To scan an open source container image, run the following command. The example below uses alpine:3.18.0 from Docker Hub.

Open Source image example

Private image example

Last updated