Consider allowing users to bring their own CycloneDX SBOM files

[Erich Smith]

There are a couple of cases where this can be helpful:

1. for whatever reason, a CycloneDX-compatible BOM file is already being generated with one of these tools
2. the underlying cdxgen cannot be made to work with the repo at hand

It would be really great to pass a path to a BOM.xml or BOM.json file via args or .sastscanrc, and have it skip the bomgen step for that run.

[Erich Smith]

When cdxgen throws, only an empty-scan-report.sarif file is generated.

[prabhu]

@erichs This is an interesting idea. dep-scan already supports scanning based on an existing bom file - https://github.com/AppThreat/dep-scan/blob/master/depscan/cli.py#L95

So a .sastscanrc file like below would work assuming a bom.json exists in src directory.

{
  "depscan": [
        "/usr/local/bin/depscan",
        "--no-banner",
        "--suggest",
        "--src",
        "%(src)s",
        "--bom",
        "%(src)s/bom.json",
        "--report_file",
        "%(report_fname_prefix)s.json"
    ]
}

[Erich Smith]

Wow, I missed that. Perfect. Thanks also for the .sastscanrc example!