BomLens supplier-SBOM lab
=========================

These are the files from the post "Your Supplier Sent an SBOM. Now What?".
They let you rebuild the whole exercise from scratch. You need Docker running
and roughly 2 GB of disk for the images.

Files
-----
package.json.txt  The "supplier" app. Pinned to old, known-vulnerable releases
                  of lodash, minimist, axios, node-fetch, and ejs on purpose.
                  Shipped as .txt so GitHub's dependency graph does not parse it
                  and open Dependabot alerts. Rename it to package.json to use it.
index.js          A tiny source file so the project looks real to the scanner.
                  (It does not need to do anything useful.)
vendor-sbom.json  A deliberately LOW-QUALITY CycloneDX SBOM for the same app:
                  one component with no PURL, one tagged pkg:generic, and no
                  transitive dependencies. This is the "bad supplier SBOM".
run.sh            Runs every step in the post and prints the exit codes.

Quick start
-----------
1. git clone --depth 1 https://github.com/sktelecom/bomlens.git
2. docker pull ghcr.io/sktelecom/bomlens:latest
3. Put package.json (rename package.json.txt back) and index.js in a folder
   named acme-payments/ next to bomlens/, put vendor-sbom.json beside it, then
   run ./run.sh from there.

Everything runs locally. The only network calls are the image pull, the Trivy
vulnerability database download, and the EPSS/CISA KEV enrichment lookups.
Set SECURITY_ENRICH=false to skip the enrichment on an air-gapped network.