{"_id":"@cognoshift/sanad-sbom","name":"@cognoshift/sanad-sbom","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@cognoshift/sanad-sbom","version":"0.1.0","description":"Sanad Sign CLI — generate, sign, and verify CycloneDX SBOMs against India's sovereign attestation rail.","bin":{"sanad-sbom":"bin/sanad-sbom.js"},"engines":{"node":">=18"},"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/anupam9091/cognoshift-sentinel.git","directory":"cli/sanad-sbom"},"homepage":"https://sanad.cognoshift.in","bugs":{"url":"https://github.com/anupam9091/cognoshift-sentinel/issues","email":"support@cognoshift.in"},"author":{"name":"COGNOSHIFT PRIVATE LIMITED","email":"support@cognoshift.in","url":"https://cognoshift.in"},"keywords":["sbom","aibom","cyclonedx","attestation","sigstore","ed25519","supply-chain","cert-in","sebi-cscrf","rbi","dpdp","india","sovereign","sanad","cognoshift"],"publishConfig":{"access":"public"},"dependencies":{},"gitHead":"421660d462bf1fab88d320db7e462e65019099e4","_id":"@cognoshift/sanad-sbom@0.1.0","_nodeVersion":"24.14.1","_npmVersion":"11.12.1","dist":{"integrity":"sha512-RzdtzYxeN0N1nObddzlwljjO+k+AWAXQDrQdxON8gl8eg6EfoH7r72ryAQkJlBCpJeOxCBiLQI4EhOXaAKiFoQ==","shasum":"165828bccb5422c74bd2410b323820741f1474e6","tarball":"https://registry.npmjs.org/@cognoshift/sanad-sbom/-/sanad-sbom-0.1.0.tgz","fileCount":4,"unpackedSize":29220,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCEev/ds4mVDas5KtDNvibXL+mZSwH3dnxm26U5b4/ytAIgNgDBpi5Be183mGwkijfwmoUHPXo+RoJdnc4GvU9N70Y="}]},"_npmUser":{"name":"cognoshift1","email":"founder@cognoshift.in"},"directories":{},"maintainers":[{"name":"cognoshift1","email":"founder@cognoshift.in"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/sanad-sbom_0.1.0_1776862896655_0.8446359050411223"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-22T13:01:36.510Z","0.1.0":"2026-04-22T13:01:36.809Z","modified":"2026-04-22T13:01:37.035Z"},"maintainers":[{"name":"cognoshift1","email":"founder@cognoshift.in"}],"description":"Sanad Sign CLI — generate, sign, and verify CycloneDX SBOMs against India's sovereign attestation rail.","homepage":"https://sanad.cognoshift.in","keywords":["sbom","aibom","cyclonedx","attestation","sigstore","ed25519","supply-chain","cert-in","sebi-cscrf","rbi","dpdp","india","sovereign","sanad","cognoshift"],"repository":{"type":"git","url":"git+https://github.com/anupam9091/cognoshift-sentinel.git","directory":"cli/sanad-sbom"},"author":{"name":"COGNOSHIFT PRIVATE LIMITED","email":"support@cognoshift.in","url":"https://cognoshift.in"},"bugs":{"url":"https://github.com/anupam9091/cognoshift-sentinel/issues","email":"support@cognoshift.in"},"license":"Apache-2.0","readme":"# sanad-sbom\n\nSanad Sign CLI — generate, sign, and verify CycloneDX SBOMs against India's sovereign attestation rail.\n\nZero dependencies. Node 18+. Works against any Sanad Sign-compatible endpoint (defaults to `https://sanad.cognoshift.in`).\n\n## Install\n\n```bash\nnpm install -g @cognoshift/sanad-sbom\n```\n\nOr run directly without installing:\n\n```bash\nnpx @cognoshift/sanad-sbom push --source sentinel_inventory --subject my-app\n```\n\n## Authenticate\n\nSet your tenant license key either as a flag or an environment variable:\n\n```bash\nexport SANAD_LICENSE_KEY=\"CS-CIV-...\"   # recommended for CI/CD\n```\n\n## Commands\n\n### `push` — generate + sign in one step (most common)\n\nAll sources flow through `push` the same way. The `--source` flag picks the input.\n\n**Fleet inventory** — Sanad Sentinel-managed endpoints (server-side, needs tenant key):\n\n```bash\nsanad-sbom push --source sentinel_inventory --subject \"my-fleet-$(date +%F)\"\n```\n\n**Container image** — Docker / OCI, via local [Syft](https://github.com/anchore/syft):\n\n```bash\nsanad-sbom push --source container --image docker:my-app:v1.2.3 --public\n\n# One-time Syft install:\ncurl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin\n```\n\n**npm** — parses `package-lock.json` (v1/v2/v3). Zero extra deps.\n\n```bash\nsanad-sbom push --source npm --public\n# Or point at a specific lockfile:\nsanad-sbom push --source npm --manifest /path/to/package-lock.json\n```\n\n**pip** — parses `requirements.txt` (or `pip freeze > reqs.txt`):\n\n```bash\nsanad-sbom push --source pip --public\nsanad-sbom push --source pip --manifest requirements-prod.txt\n```\n\n**maven** — parses `pom.xml` `<dependencies>` (direct deps only; test-scope skipped):\n\n```bash\nsanad-sbom push --source maven --public\n# For full transitive graph, run Syft on target/:\nsyft dir:./target -o cyclonedx-json | sanad-sbom sign --sbom - --subject \"my-app@$(git rev-parse --short HEAD)\"\n```\n\n**nuget** — parses `packages.lock.json` (enable via `msbuild /t:restore /p:RestorePackagesWithLockFile=true`):\n\n```bash\nsanad-sbom push --source nuget --public\n```\n\nAll sources emit CycloneDX 1.6, sign with Ed25519, and register in the Sanad ledger. Subject defaults to the project coordinates (`name@version` from the manifest) if not supplied.\n\n### `generate` — produce an SBOM without signing\n\n```bash\nsanad-sbom generate --source sentinel_inventory --output sbom.json\n```\n\n### `sign` — sign an existing SBOM JSON file\n\n```bash\nsanad-sbom sign --sbom sbom.json --subject my-app --public\n```\n\n`--public` makes the signed attestation world-readable on the registry.\n\n### `verify` — confirm a signed attestation\n\nOnline (looks up the attestation + replays the hash chain):\n\n```bash\nsanad-sbom verify --id <attestation-uuid>\n```\n\nOffline (pure cryptography, no network):\n\n```bash\nsanad-sbom verify \\\n  --sbom sbom.json \\\n  --signature \"<base64>\" \\\n  --public-key \"<base64>\"\n```\n\n## Flags\n\n| Flag | Description |\n|---|---|\n| `--license-key <KEY>` | Tenant license key. Or use `SANAD_LICENSE_KEY` env. |\n| `--endpoint <URL>` | Override the default endpoint. Or use `SANAD_ENDPOINT` env. |\n| `--json` | Machine-readable JSON output (good for CI pipelines). |\n\n## GitHub Actions\n\n```yaml\n- name: Sign SBOM\n  run: |\n    npm install -g @cognoshift/sanad-sbom\n    sanad-sbom push --source sentinel_inventory --subject \"${{ github.repository }}@${{ github.sha }}\"\n  env:\n    SANAD_LICENSE_KEY: ${{ secrets.SANAD_LICENSE_KEY }}\n```\n\n## How verification works\n\nSanad Sign signatures are Ed25519 over the SHA-256 hash of the canonical (sorted-key) CycloneDX serialization. The public key is frozen on every attestation row at signing time, so any verifier — including auditors without access to Sanad — can verify offline using `crypto.verify()` in 10 lines of code in any language.\n\nChain integrity: every attestation is appended to a per-tenant SHA-256 hash chain anchored to the genesis constant `SANAD_SIGN_GENESIS_2026`. The `verify --id` command replays the entire chain from genesis and flags any tampering.\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md","_rev":"1-74644d30687440969a092ae6de0e0c76"}