devsecops-engine-tools 1.25.1__py3-none-any.whl → 1.26.0__py3-none-any.whl

devsecops_engine_tools/engine_core/src/infrastructure/entry_points/entry_point_core.py

@@ -21,6 +21,7 @@ def init_engine_core(
     devops_platform_gateway: any,
     print_table_gateway: any,
     metrics_manager_gateway: any,
+    sbom_tool_gateway: any,
     args: any
 ):
     config_tool = devops_platform_gateway.get_remote_config(
@@ -28,7 +29,7 @@ def init_engine_core(
     )
     Printers.print_logo_tool(config_tool["BANNER"])
 
-    if config_tool[args["tool"].upper()]["ENABLED"] == "true":
+    if config_tool[args["tool"].upper()]["ENABLED"]:
         if args["tool"] == "engine_risk":
             results, input_core = HandleRisk(
                 vulnerability_management_gateway,
@@ -42,6 +43,7 @@ def init_engine_core(
                 vulnerability_management_gateway,
                 secrets_manager_gateway,
                 devops_platform_gateway,
+                sbom_tool_gateway
             ).process(args, config_tool)
 
             results = BreakBuild(devops_platform_gateway, print_table_gateway).process(

devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -115,7 +115,7 @@ class IacScan:
 
         if dict_args["folder_path"]:
             if (
-                config_tool.update_service_file_name_cft == "True"
+                config_tool.update_service_file_name_cft
                 and "cloudformation" in dict_args["platform"]
             ):
                 files = os.listdir(os.path.join(os.getcwd(), dict_args["folder_path"]))

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -2,7 +2,6 @@ import yaml
 import subprocess
 import time
 import os
-import platform
 import queue
 import threading
 import json
@@ -171,7 +170,6 @@ class CheckovTool(ToolGateway):
                                 f"{config_tool[self.TOOL_CHECKOV]['EXTERNAL_CHECKS_GIT']}/{self.framework_mapping[rule]}"
                             ]
                             if config_tool[self.TOOL_CHECKOV]["USE_EXTERNAL_CHECKS_GIT"]
-                            == "True"
                             and agent_env is not None
                             and rule in self.framework_external_checks
                             else []
@@ -180,7 +178,6 @@ class CheckovTool(ToolGateway):
                         external_checks_dir=(
                             f"/tmp/rules/{self.framework_mapping[rule]}"
                             if config_tool[self.TOOL_CHECKOV]["USE_EXTERNAL_CHECKS_DIR"]
-                            == "True"
                             and rule in self.framework_external_checks
                             else []
                         ),

devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/tool_gateway.py

@@ -3,5 +3,5 @@ from abc import ABCMeta, abstractmethod
 
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
-    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release, base_image, exclusions) -> str:
+    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release, base_image, exclusions, generate_sbom):
         "run tool container sca"

devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -18,7 +18,7 @@ class ContainerScaScan:
         remote_config,
         tool_images: ImagesGateway,
         tool_deseralizator: DeseralizatorGateway,
-        build_id,
+        branch,
         secret_tool,
         token_engine_container,
         image_to_scan,
@@ -28,7 +28,7 @@ class ContainerScaScan:
         self.remote_config = remote_config
         self.tool_images = tool_images
         self.tool_deseralizator = tool_deseralizator
-        self.build_id = build_id
+        self.branch = branch
         self.secret_tool = secret_tool
         self.token_engine_container = token_engine_container
         self.image_to_scan = image_to_scan
@@ -82,19 +82,29 @@ class ContainerScaScan:
         matching_image = self.get_image(self.image_to_scan)
         if self.remote_config['GET_IMAGE_BASE']:
             base_image = self.get_base_image(matching_image)
+        sbom_components = None
+        generate_sbom = self.remote_config["SBOM"]["ENABLED"] and any(
+            branch in str(self.branch)
+            for branch in self.remote_config["SBOM"]["BRANCH_FILTER"]
+        )
         if matching_image:
             image_name = matching_image.tags[0]
-            result_file = image_name.replace("/","_") + "_scan_result.json"
+            result_file = image_name.replace("/", "_") + "_scan_result.json"
             if image_name in self.get_images_already_scanned():
                 print(f"The image {image_name} has already been scanned previously.")
-                return image_scanned, base_image
-            image_scanned = self.tool_run.run_tool_container_sca(
-                self.remote_config, self.secret_tool, self.token_engine_container, image_name, result_file, base_image, self.exclusions
+                return image_scanned, base_image, sbom_components
+            image_scanned, sbom_components = self.tool_run.run_tool_container_sca(
+                self.remote_config,
+                self.secret_tool,
+                self.token_engine_container,
+                image_name,
+                result_file, base_image, self.exclusions,
+                generate_sbom,
             )
             self.set_image_scanned(image_name)
         else:
             print(f"'Not image found for {self.image_to_scan}'. Tool skipped.")
-        return image_scanned, base_image
+        return image_scanned, base_image, sbom_components
 
     def deseralizator(self, image_scanned):
         """

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -8,6 +8,9 @@ import json
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
+from devsecops_engine_tools.engine_utilities.sbom.deserealizator import (
+    get_list_component,
+)
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -97,13 +100,53 @@ class PrismaCloudManagerScan(ToolGateway):
         except subprocess.CalledProcessError as e:
              logger.error(f"Error during write image base of {base_image}: {e.stderr}")
             
+    def _generate_sbom(self, image_scanned, remoteconfig, prisma_secret_key, image_name):
+
+        url = f"{remoteconfig['PRISMA_CLOUD']['PRISMA_CONSOLE_URL']}/api/{remoteconfig['PRISMA_CLOUD']['PRISMA_API_VERSION']}/sbom/download/cli-images"
+        credentials = base64.b64encode(
+            f"{remoteconfig['PRISMA_CLOUD']['PRISMA_ACCESS_KEY']}:{prisma_secret_key}".encode()
+        ).decode()
+        headers = {"Authorization": f"Basic {credentials}"}
+        try:
+
+            with open(image_scanned, "rb") as file:
+                image_object = file.read()
+                json_data = json.loads(image_object)
+
+            if not json_data["results"]:
+                print("No results found in the scan, SBOM not generated")
+                return None
+
+            response = requests.get(
+                url,
+                headers=headers,
+                params={
+                    "id": json_data["results"][0]["scanID"],
+                    "sbomFormat": remoteconfig["PRISMA_CLOUD"]["SBOM_FORMAT"],
+                },
+            )
+            response.raise_for_status()
+
+            result_sbom = f"{image_name.replace('/', '_')}_SBOM.json"
+            with open(result_sbom, "wb") as file:
+                file.write(response.content)
+            
+            print(f"SBOM generated and saved to: {result_sbom}")
+
+            return get_list_component(result_sbom, remoteconfig["PRISMA_CLOUD"]["SBOM_FORMAT"])
+        except Exception as e:
+            logger.error(f"Error generating SBOM: {e}")
+
     def run_tool_container_sca(
-        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions
+        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom
     ):
-        prisma_secret_key = secret_tool["token_prisma_cloud"] if secret_tool else token_engine_container
+        prisma_secret_key = (
+            secret_tool["token_prisma_cloud"] if secret_tool else token_engine_container
+        )
         file_path = os.path.join(
             os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"]
         )
+        sbom_components = None
 
         if not os.path.exists(file_path):
             self.download_twistcli(
@@ -122,5 +165,12 @@ class PrismaCloudManagerScan(ToolGateway):
         )
         if base_image:
             self._write_image_base(result_file, base_image, exclusions)
+        if generate_sbom:
+            sbom_components = self._generate_sbom(
+                image_scanned,
+                remoteconfig,
+                prisma_secret_key,
+                image_name
+            )
 
-        return image_scanned
+        return image_scanned, sbom_components

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -12,6 +12,10 @@ import json
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
+from devsecops_engine_tools.engine_utilities.sbom.deserealizator import (
+    get_list_component,
+)
+
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
@@ -24,9 +28,9 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error downloading trivy: {e}")
 
-    def install_tool(self, file, url):
+    def install_tool(self, file, url, command_prefix):
         installed = subprocess.run(
-            ["which", "./trivy"],
+            ["which", command_prefix],
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
         )
@@ -35,21 +39,26 @@ class TrivyScan(ToolGateway):
                 self.download_tool(file, url)
                 with tarfile.open(file, 'r:gz') as tar_file:
                     tar_file.extract(member=tar_file.getmember("trivy"))
+                    return "./trivy"
             except Exception as e:
                 logger.error(f"Error installing trivy: {e}")
+        else:
+            return installed.stdout.decode().strip()
         
-    def install_tool_windows(self, file, url):
+    def install_tool_windows(self, file, url, command_prefix):
         try:
             subprocess.run(
-                ["./trivy.exe", "--version"],
+                [command_prefix, "--version"],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
             )
+            return command_prefix
         except:
             try:
                 self.download_tool(file, url)
                 with zipfile.ZipFile(file, 'r') as zip_file:
                     zip_file.extract(member="trivy.exe")
+                    return "./trivy.exe"
             except Exception as e:
                 logger.error(f"Error installing trivy: {e}")
 
@@ -79,24 +88,49 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error during image scan of {image_name}: {e}")
 
-    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file ,base_image, exclusions):
+    def _generate_sbom(self, prefix, image_name, remoteconfig):
+        result_sbom = f"{image_name.replace('/', '_')}_SBOM.json"
+        command = [
+            prefix,
+            "image",
+            "--format",
+            remoteconfig["TRIVY"]["SBOM_FORMAT"],
+            "--output",
+            result_sbom
+        ]
+        command.extend(["--quiet", image_name])
+        try:
+            subprocess.run(
+                command,
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            print(f"SBOM generated and saved to: {result_sbom}")
+
+            return get_list_component(result_sbom, remoteconfig["TRIVY"]["SBOM_FORMAT"])
+
+        except Exception as e:
+            logger.error(f"Error generating SBOM: {e}")
+
+    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom):
         trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
         os_platform = platform.system()
         arch_platform = platform.architecture()[0]
         base_url = f"https://github.com/aquasecurity/trivy/releases/download/v{trivy_version}/"
+        sbom_components = None
 
+        command_prefix = "trivy"
         if os_platform == "Linux":
             file=f"trivy_{trivy_version}_Linux-{arch_platform}.tar.gz"
-            self.install_tool(file, base_url+file)
-            command_prefix = "./trivy"
+            command_prefix = self.install_tool(file, base_url+file, "trivy")
         elif os_platform == "Darwin":
             file=f"trivy_{trivy_version}_macOS-{arch_platform}.tar.gz"
-            self.install_tool(file, base_url+file)
-            command_prefix = "./trivy"
+            command_prefix = self.install_tool(file, base_url+file, "trivy")
         elif os_platform == "Windows":
             file=f"trivy_{trivy_version}_windows-{arch_platform}.zip"
-            self.install_tool_windows(file, base_url+file)
-            command_prefix = "./trivy.exe"
+            command_prefix = self.install_tool_windows(file, base_url+file, "trivy.exe")
         else:
             logger.warning(f"{os_platform} is not supported.")
             return None
@@ -104,5 +138,7 @@ class TrivyScan(ToolGateway):
         image_scanned = (
             self.scan_image(command_prefix, image_name, result_file, base_image)
         )
+        if generate_sbom:
+            sbom_components = self._generate_sbom(command_prefix, image_name, remoteconfig)
 
-        return image_scanned
+        return image_scanned, sbom_components

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -34,11 +34,12 @@ def init_engine_sca_rm(
     )
     skip_flag = handle_remote_config_patterns.skip_from_exclusion()
     scan_flag = handle_remote_config_patterns.ignore_analysis_pattern()
-    build_id = tool_remote.get_variable("build_id")
+    branch = tool_remote.get_variable("branch_tag")
     stage = tool_remote.get_variable("stage")
     image_to_scan = dict_args["image_to_scan"]
     image_scanned = None
     base_image = None
+    sbom_components = None
     deseralized = []
     input_core = SetInputCore(remote_config, exclusions, pipeline_name, tool, stage)
     if scan_flag and not (skip_flag):
@@ -47,13 +48,13 @@ def init_engine_sca_rm(
             remote_config,
             tool_images,
             tool_deseralizator,
-            build_id,
+            branch,
             secret_tool,
             dict_args["token_engine_container"],
             image_to_scan,
             exclusions
         )
-        image_scanned,base_image = container_sca_scan.process()
+        image_scanned, base_image, sbom_components = container_sca_scan.process()
         if image_scanned:
             deseralized = container_sca_scan.deseralizator(image_scanned)
     else:
@@ -61,4 +62,4 @@ def init_engine_sca_rm(
         dict_args["send_metrics"] = "false"
     core_input = input_core.set_input_core(image_scanned,base_image)
 
-    return deseralized, core_input
+    return deseralized, core_input, sbom_components

devsecops_engine_tools/engine_sca/engine_dependencies/src/applications/runner_dependencies_scan.py

@@ -16,20 +16,22 @@ from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.en
 
 
 def runner_engine_dependencies(
-    dict_args, config_tool, secret_tool, devops_platform_gateway
+    dict_args, config_tool, secret_tool, devops_platform_gateway, sbom_tool_gateway
 ):
     try:
         tools_mapping = {
-            "XRAY": {"tool_run": XrayScan, "tool_deserializator": XrayDeserializator},
+            "XRAY": {"tool_run": XrayScan, "tool_deserializator": XrayDeserializator, "tool_sbom": sbom_tool_gateway},
             "DEPENDENCY_CHECK": {
                 "tool_run": DependencyCheckTool,
                 "tool_deserializator": DependencyCheckDeserialize,
+                "tool_sbom": sbom_tool_gateway
             },
         }
 
         selected_tool = config_tool["ENGINE_DEPENDENCIES"]["TOOL"]
         tool_run = tools_mapping[selected_tool]["tool_run"]()
         tool_deserializator = tools_mapping[selected_tool]["tool_deserializator"]()
+        tool_sbom = tools_mapping[selected_tool]["tool_sbom"]
 
         return init_engine_dependencies(
             tool_run,
@@ -37,7 +39,8 @@ def runner_engine_dependencies(
             tool_deserializator,
             dict_args,
             secret_tool,
-            config_tool["ENGINE_DEPENDENCIES"]["TOOL"],
+            config_tool,
+            tool_sbom
         )
 
     except Exception as e:

devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py

@@ -7,9 +7,14 @@ from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.usecases.s
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.usecases.handle_remote_config_patterns import (
     HandleRemoteConfigPatterns,
 )
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.sbom_manager import (
+    SbomManagerGateway,
+)
 
 import os
-import sys
 
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
@@ -18,7 +23,13 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 def init_engine_dependencies(
-    tool_run, tool_remote, tool_deserializator, dict_args, secret_tool, tool
+    tool_run,
+    tool_remote: DevopsPlatformGateway,
+    tool_deserializator,
+    dict_args,
+    secret_tool,
+    config_tool,
+    tool_sbom: SbomManagerGateway,
 ):
     remote_config = tool_remote.get_remote_config(
         dict_args["remote_config_repo"],
@@ -40,7 +51,14 @@ def init_engine_dependencies(
 
     dependencies_scanned = None
     deserialized = []
-    input_core = SetInputCore(remote_config, exclusions, pipeline_name, tool)
+    sbom_components = None
+    config_sbom = config_tool["SBOM_MANAGER"]
+    input_core = SetInputCore(
+        remote_config,
+        exclusions,
+        pipeline_name,
+        config_tool["ENGINE_DEPENDENCIES"]["TOOL"],
+    )
 
     if scan_flag and not (skip_flag):
         to_scan = dict_args["folder_path"] if dict_args["folder_path"] else os.getcwd()
@@ -55,6 +73,15 @@ def init_engine_dependencies(
                 to_scan,
                 secret_tool,
             )
+            if config_sbom["ENABLED"] and any(
+                branch in str(tool_remote.get_variable("branch_tag"))
+                for branch in config_sbom["BRANCH_FILTER"]
+            ):
+                sbom_components = tool_sbom.get_components(
+                    to_scan,
+                    config_sbom,
+                    pipeline_name
+                )
             dependencies_scanned = dependencies_sca_scan.process()
             deserialized = (
                 dependencies_sca_scan.deserializator(dependencies_scanned)
@@ -69,4 +96,4 @@ def init_engine_dependencies(
 
     core_input = input_core.set_input_core(dependencies_scanned)
 
-    return deserialized, core_input
+    return deserialized, core_input, sbom_components

devsecops_engine_tools/engine_utilities/defect_dojo/__init__.py

@@ -4,4 +4,5 @@ from .applications.defect_dojo import DefectDojo
 from .applications.finding import Finding
 from .applications.connect import Connect
 from .applications.engagement import Engagement
-from .applications.product import Product
+from .applications.product import Product
+from .applications.component import Component

devsecops_engine_tools/engine_utilities/defect_dojo/applications/component.py

@@ -0,0 +1,29 @@
+from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.component import ComponentRestConsumer
+from devsecops_engine_tools.engine_utilities.defect_dojo.domain.user_case.component import ComponentUserCase
+from devsecops_engine_tools.engine_utilities.settings import SETTING_LOGGER
+
+logger = MyLogger.__call__(**SETTING_LOGGER).get_logger()
+
+class Component:
+
+    @staticmethod
+    def get_component(session, request: dict):
+        try:
+            rest_component = ComponentRestConsumer(session=session)
+            uc = ComponentUserCase(rest_component)
+            return uc.get(request)
+        except ApiError as e:
+            logger.error(f"Error during get component: {e}")
+            raise e
+    
+    @staticmethod
+    def create_component(session, request):
+        try:
+            rest_component = ComponentRestConsumer(session=session)
+            uc = ComponentUserCase(rest_component)
+            return uc.post(request)
+        except ApiError as e:
+            logger.error(f"Error during create component: {e}")
+            raise e

devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/component.py

@@ -0,0 +1,20 @@
+import dataclasses
+from typing import List
+from devsecops_engine_tools.engine_utilities.utils.dataclass_classmethod import FromDictMixin
+
+
+@dataclasses.dataclass
+class Component(FromDictMixin):
+    id: int = 0
+    name: str = ""
+    version: str = ""
+    date: str = ""
+    Component_id: int = 0
+
+
+@dataclasses.dataclass
+class ComponentList(FromDictMixin):
+    count: int = 0
+    next = None
+    previous = None
+    results: List[Component] = dataclasses.field(default_factory=list)

devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/component.py

@@ -0,0 +1,11 @@
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.component import ComponentRestConsumer
+
+class ComponentUserCase:
+    def __init__(self, rest_component: ComponentRestConsumer):
+        self.__rest_component = rest_component
+
+    def get(self, request):
+        return self.__rest_component.get_component(request)
+    
+    def post(self, request):
+        return self.__rest_component.post_component(request)

devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/component.py

@@ -0,0 +1,52 @@
+import json
+from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.settings.settings import VERIFY_CERTIFICATE
+from devsecops_engine_tools.engine_utilities.utils.session_manager import SessionManager
+from devsecops_engine_tools.engine_utilities.settings import SETTING_LOGGER
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+
+from devsecops_engine_tools.engine_utilities.defect_dojo.domain.models.component import ComponentList, Component
+
+logger = MyLogger.__call__(**SETTING_LOGGER).get_logger()
+
+
+class ComponentRestConsumer:
+    def __init__(self, session: SessionManager):
+        self.__token = session._token
+        self.__host = session._host
+        self.__session = session._instance
+
+    def get_component(self, request):
+        url = f"{self.__host}/api/v2/components/"
+        headers = {
+            "Authorization": f"Token {self.__token}",
+            "Content-Type": "application/json",
+        }
+        try:
+            response = self.__session.get(
+                url=url, headers=headers, params=request, verify=VERIFY_CERTIFICATE
+            )
+            if response.status_code != 200:
+                logger.error(response.json())
+                raise ApiError(response.json())
+            components = ComponentList().from_dict(response.json())
+        except Exception as e:
+            raise ApiError(e)
+        return components
+    
+    def post_component(self, request):
+        url = f"{self.__host}/api/v2/components/"
+        headers = {
+            "Authorization": f"Token {self.__token}",
+            "Content-Type": "application/json",
+        }
+        try:
+            response = self.__session.post(
+                url=url, headers=headers, data=json.dumps(request), verify=VERIFY_CERTIFICATE
+            )
+            if response.status_code != 201:
+                raise ApiError(response.json())
+            response = Component.from_dict(response.json())
+        except Exception as e:
+            raise ApiError(e)
+        return response

devsecops_engine_tools/engine_utilities/sbom/deserealizator.py

@@ -0,0 +1,24 @@
+import json
+
+from devsecops_engine_tools.engine_core.src.domain.model.component import Component
+
+
+def get_list_component(result_sbom, format) -> "list[Component]":
+    list_components = []
+
+    with open(result_sbom, "rb") as file:
+        sbom_object = file.read()
+        json_data = json.loads(sbom_object)
+
+        if "cyclonedx" in format:
+            for component in json_data.get("components", []):
+                if component.get("version") != "UNKNOWN":
+                    component_name = (
+                        f"{component.get('group','')}_{component.get('name')}"
+                        if component.get("group")
+                        else component.get("name")
+                    )
+                    list_components.append(
+                        Component(component_name, component.get("version"))
+                    )
+        return list_components