csspin-tooling is maintained by CONTACT Software GmbH and provides utility plugins and tasks to be used with the csspin task runner.

The following plugins are available:

• csspin_tooling.sbomasm: Assembles multiple CycloneDX SBOM files into a single enriched top-level SBOM using the sbomasm tool.
• csspin_tooling.fetch_vex: Downloads a CycloneDX VEX file for a given package version from Dependency-Track.

Prerequisites

csspin must be installed before using this package:

python -m pip install csspin

Using csspin-tooling

Add the package and the desired plugins to your project's spinfile.yaml:

spin:
project_name: my_projectplugin_packages:
- csspin-python
- csspin-toolingplugins:
- csspin_tooling.sbomasm
- csspin_tooling.fetch_vexpython:
version: "3.11.9"

Provision the project to download sbomasm and install all dependencies:

spin provision

Assemble a top-level SBOM from all *.cdx.json files in the project root:

spin sbom --help