OmniTrustILM/cbom-lens

CBOM-Lens

CLI tool to scan filesystems, containers, and network ports for cryptographic assets and generate a CycloneDX CBOM 1.6.

CBOM-Lens discovers certificates, keys, secrets, and algorithms across local files, container images, and services, and emits a consistent Cryptographic Bill of Materials (CBOM) that can be uploaded to a CBOM-Repository or consumed by external applications.

---

Features

• Multiple scan targets
• Local filesystem (certificates, keys, secrets).
• Container images from Docker/Podman.
• Network ports using nmap (TLS and SSH detection).
• CycloneDX CBOM 1.6 output
• Stable, content-based bom-ref identifiers to correlate the same cryptographic assets across sources.

• Privacy-aware handling of private keys and algorithm components.
• Flexible operation modes
• One-shot manual runs (good for CI and ad-hoc scans).
• Timer mode with cron expressions or ISO-8601 durations.
• Discovery mode managed by CZERTAINLY Core.
• Integration-ready

• Optional upload to a CBOM-Repository.
• Designed to integrate into various applications.

For a conceptual overview and background, see the Overview.

---

Quick Start

Install

Build from source (requires Go):

cd CBOM-Lens

go build -o cbom-lens ./cmd/cbom-lens
./cbom-lens --help

For a guided walkthrough including install and first scans, see the Quick Start.

Minimal filesystem scan

Create a config file cbom-lens.yaml:

version: 0

service:
  mode: manual
  verbose: false
  log: stderr
  # Save CBOM files in the current directory; omit to print to stdout
  dir: .

filesystem:
  enabled: true
  # When empty, the current directory is scanned