jake_conda_vulnerability_scan_with_ossindex_and_cyclonedx_sbom.py

1# Note: Jake is primarily a command-line tool. 
2# While it can be imported, the official "quickstart" 
3# usage is via the shell. Below is the equivalent 
4# Pythonic way to invoke a scan programmatically.
5
6from jake.pip.pip import Pip
7from jake.ossindex.ossindex import OssIndex
8from jake.cyclonedx.generator import CycloneDxSbomGenerator
9
10# 1. Collect dependencies from the current environment
11pip_handler = Pip()
12dependencies = pip_handler.get_dependencies()
13
14# 2. Submit dependencies to OSS Index for vulnerability scanning
15oss_index = OssIndex()
16results = oss_index.call_ossindex(dependencies)
17
18# 3. Generate a CycloneDX SBOM from the results
19sbom_gen = CycloneDxSbomGenerator()
20sbom_xml = sbom_gen.purl_to_code(results)
21
22# Print the vulnerability report
23for component in results:
24    if component.get_vulnerabilities():
25        print(f"Vulnerability found in {component.get_name()}: {component.get_vulnerabilities()}")