Before moving on, please consider giving us a GitHub star ⭐️. Thank you!

BitBom Minefield is a tool that uses roaring-Bitmaps to graph SBOMs FAST.

Caching 10,000 SBOMs packages transitive dependents in 30 seconds.

Table of Contents

1. Quickstart Guide
2. Example
3. To Start Using Minefield
   • Using Docker
   • Building From Source
4. How Minefield Works
5. Custom Query Commands
6. Visualization of a Query
7. Documentation
8. Blog
9. Star History
10. Acknowledgements

View Minefield demo on asciinema

Quickstart Guide

1. Ingest some data:

   minefield ingest sbom <sbom_file or sbom_dir>

2. Cache the data:

   minefield cache

3. Run a query:

   minefield query <query_string>

Example

Redis must be running at localhost:6379. If not, please use make docker-up to start Redis.

1. Ingest the test SBOM directory:

   minefield ingest sbom test

2. Cache the data:

   minefield cache

3. Run the leaderboard custom with "dependents PACKAGE":
   • This command generates a ranked list of packages, ordered by the number of other packages that depend on them.

   minefield leaderboard custom "dependents PACKAGE"

4. Run a query on the top value from the leaderboard:
   • This command queries the dependents for a specific package, in this case dep2.

   minefield query "dependents PACKAGE pkg:generic/[email protected]"

5. Run queries to see the shared dependencies of lib-A and dep1, and lib-A and lib-B:
   • These queries output the intersection of two queries, finding package dependencies shared between each pair.

   minefield query "dependencies PACKAGE pkg:generic/[email protected] and dependencies PACKAGE pkg:generic/[email protected]"

   minefield query "dependencies PACKAGE pkg:generic/[email protected] and dependencies PACKAGE pkg:generic/[email protected]"

6. Run queries with the visualizer:

   minefield query "dependents PACKAGE pkg:generic/[email protected] --visualize"

To Start Using Minefield

Using Docker

docker pull ghcr.io/bitbomdev/minefield:latest
docker run -it ghcr.io/bitbomdev/minefield:latest

Building From Source

git clone https://github.com/bitbomdev/minefield.git
cd minefield
go build -o minefield main.go
./minefield

How Minefield Works

The design decisions and architecture of Minefield can be found here.

Visualization of a Query

Documentation

For comprehensive guides and detailed documentation, please visit our Docs.

Blog

Stay updated with the latest news and insights by visiting our Blog.

Star History

Acknowledgements

• https://github.com/RoaringBitmap/roaring