Installation

The installation consists of two main components:

• Minefield: The core engine that graphs and analyzes Software Bill of Materials (SBOM) data
• Scorecard Downloader: A tool to fetch OpenSSF Scorecard data for GitHub repositories (optional)

Installing Minefield

Git

git clone git@github.com:bitbomdev/minefield.git
cd minefield
go build -o minefield main.go

GitHub CLI

gh repo clone bitbomdev/minefield
cd minefield
go build -o minefield main.go

Docker

docker pull ghcr.io/bitbomdev/minefield:latest
docker run -it ghcr.io/bitbomdev/minefield:latest

Go Install

go get github.com/bitbomdev/minefield

Installing Scorecard Downloader (Optional)

The Scorecard Downloader helps fetch security metrics data that can be ingested into Minefield. You can skip this step if you have your own data source.

Git

git clone git@github.com:bitbomdev/scorecard-downloader.git
cd scorecard-downloader
go build

GitHub CLI

gh repo clone bitbomdev/scorecard-downloader
cd scorecard-downloader
go build

Go Install

go get github.com/bitbomdev/scorecard-downloader