csspin-tooling is maintained by CONTACT Software GmbH and provides utility plugins and tasks to be used with the csspin task runner.

The following plugins are available:

• csspin_tooling.sbomasm: Assembles multiple CycloneDX SBOM files into a single enriched top-level SBOM using the sbomasm tool.

Prerequisites

csspin must be installed before using this package:

python -m pip install csspin

Using csspin-tooling

Add the package and the desired plugins to your project's spinfile.yaml:

spin:
  project_name: my_project

plugin_packages:
  - csspin-python
  - csspin-tooling

plugins:
  - csspin_tooling.sbomasm

python:
  version: "3.11.9"

Provision the project to download sbomasm and install all dependencies:

spin provision

Assemble a top-level SBOM from all *.cdx.json files in the project root:

spin sbom --help