https://korea-wg.openchainproject.org/en/tags/cdxgen/Recent content in Cdxgen on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/tools/5-cdxgen/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/tools/5-cdxgen/<p>cdxgen is an open source SBOM generation tool managed by OWASP (Open Web Application Security Project). It analyzes source code, build artifacts, and container images to automatically generate SBOMs in <a href="https://cyclonedx.org/">CycloneDX</a> format.</p> <ul> <li>GitHub: <a href="https://github.com/CycloneDX/cdxgen">https://github.com/CycloneDX/cdxgen</a></li> <li>License: Apache-2.0</li> </ul> <h2 id="features">Features</h2> <ul> <li><strong>Wide language and ecosystem support</strong>: Java (Maven/Gradle), Node.js, Python, Go, Rust, PHP, Ruby, .NET, and 20+ more</li> <li><strong>Multiple scan targets</strong>: Source code directories, container images, GitHub repositories</li> <li><strong>CycloneDX standard output</strong>: Supports CycloneDX 1.4/1.5/1.6 in JSON and XML formats</li> <li><strong>REPL mode</strong>: Interactive interface for exploring and querying SBOMs</li> <li><strong>CI/CD integration</strong>: Easy integration with GitHub Actions, GitLab CI, and other major pipelines</li> </ul> <h2 id="installation">Installation</h2> <p>Install with Node.js 18 or later:</p>https://korea-wg.openchainproject.org/en/guide/tools/8-cdxgen-dt/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/tools/8-cdxgen-dt/<p>For companies just starting with open source management, we recommend the <strong>cdxgen + Dependency-Track</strong> combination as a toolset that can establish a basic automation environment within a single day.</p> <p>This guide walks you through every step, from installation and configuration to setting up a license and vulnerability inspection environment and running day-to-day operations.</p> <h2 id="why-cdxgen--dependency-track">Why cdxgen + Dependency-Track</h2> <p>Open source management comes down to two essentials.</p> <ol> <li><strong>Know what is inside</strong> — generating an SBOM (Software Bill of Materials)</li> <li><strong>Continuously monitor risk</strong> — detecting vulnerabilities (CVEs) and license policy violations</li> </ol> <p>cdxgen handles the first, and Dependency-Track handles the second. Both tools are <strong>free open source</strong> under the Apache-2.0 license.</p>