Downloading SBOM and VEX Files for a Release

#!/usr/bin/env bash
# Scans the applications of a CoreMedia Content Cloud release with Trivy, using the
# published SBOM and VEX files.
#
# Usage: scan-sbom-vex.sh <release-files-url> [additional trivy options]
#   <release-files-url> is the "SBOM & VEX (JSON)" link of the release or a local copy
#   of the JSON document.
#
# Environment:
#   CM_NEXUS_USER      user name for the CoreMedia Nexus repository
#   CM_NEXUS_PASSWORD  password or token for the CoreMedia Nexus repository
#
# Example: scan-sbom-vex.sh "$URL" --severity HIGH,CRITICAL --exit-code 1
# The script exits with a non-zero status if a download fails or if Trivy fails, which
# includes findings when --exit-code 1 is given.
set -euo pipefail

[ $# -ge 1 ] || { echo "Usage: $0 <release-files-url> [trivy options]" >&2; exit 1; }
source_ref="$1"
shift

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

download() { # <url> <target file>
  local auth=()
  [ -n "${CM_NEXUS_USER:-}" ] && auth=(-u "${CM_NEXUS_USER}:${CM_NEXUS_PASSWORD:-}")
  curl -fsSL ${auth[@]+"${auth[@]}"} -o "$2" "$1"
}

# Collect the download URLs of all pages of the search result
: > "$tmp/urls.txt"
if [ -f "$source_ref" ]; then
  # A local copy cannot be paged, so it must contain the complete result
  if [ -n "$(jq -r '.continuationToken // empty' "$source_ref")" ]; then
    echo "$source_ref is an incomplete page of the search result; use the JSON link instead" >&2
    exit 1
  fi
  jq -r '.items[].assets[].downloadUrl' "$source_ref" >> "$tmp/urls.txt"
else
  token=""
  while :; do
    download "${source_ref}${token:+&continuationToken=${token}}" "$tmp/page.json"
    jq -r '.items[].assets[].downloadUrl' "$tmp/page.json" >> "$tmp/urls.txt"
    token="$(jq -r '.continuationToken // empty' "$tmp/page.json")"
    [ -n "$token" ] || break
  done
fi

# To scan SBOMs of your customized Blueprint or Docker images instead of the published
# SBOMs, replace the download of "$sbom_url" and the trivy call below accordingly.
status=0
found=0
while IFS= read -r sbom_url <&3; do
  found=$((found + 1))
  vex_url="${sbom_url%.sbom.json}.vex.json"
  echo "==> ${sbom_url%/application.sbom.json}"
  download "$sbom_url" "$tmp/sbom.json"
  vex=()
  if grep -qxF "$vex_url" "$tmp/urls.txt"; then
    download "$vex_url" "$tmp/vex.json"
    vex=(--vex "$tmp/vex.json" --show-suppressed)
  else
    echo "No VEX file found, scanning without it" >&2
  fi
  trivy sbom --quiet ${vex[@]+"${vex[@]}"} ${@+"$@"} "$tmp/sbom.json" || status=1
done 3< <(grep '\.sbom\.json$' "$tmp/urls.txt")
[ "$found" -gt 0 ] || { echo "No SBOM files found at ${source_ref}" >&2; exit 1; }
exit "$status"

export CM_NEXUS_USER=<user>
export CM_NEXUS_PASSWORD=<password-or-token>
bash scan-sbom-vex.sh \
  "https://repository.coremedia.com/nexus/service/rest/v1/search?repository=sbom&tag=cms-cmcc-13-2512.1.2" \
  --severity HIGH,CRITICAL --exit-code 1