Skip to content

Commit 717ea47

Browse files
mgcmrnjudge
authored andcommitted
fix(docs): Removed the '$ ' prefix on all README.md commands, so they can be copy pasted into terminals without further editing
1 parent 2aab4fb commit 717ea47

File tree

1 file changed

+44
-44
lines changed

1 file changed

+44
-44
lines changed

README.md

+44-44
Original file line numberDiff line numberDiff line change
@@ -82,47 +82,47 @@ Once installed, make sure the docker daemon is running.
8282

8383
Create a python3 virtual environment:
8484
```
85-
$ python3 -m venv ternenv
86-
$ cd ternenv
85+
python3 -m venv ternenv
86+
cd ternenv
8787
```
8888

8989
*NOTE:* Your OS might distribute each Python version separately. For example, on Ubuntu LTS, Python 2.7 is linked to `python2` and Python 3.6 is linked to `python3`. I develop with Python 3.7 which is installed separately with no symlinks. In this case, I use the binary. The binaries are usually installed in `/usr/bin/python`.
9090

9191
Activate the virtual environment:
9292
```
93-
$ source bin/activate
93+
source bin/activate
9494
```
9595
NOTE: This specific activate script only works for Bash shells. If you need to activate a Fish Shell or C Shell you should use `source bin/activate.fish` or `source bin/activate.csh`, respectively.
9696

9797
Install tern:
9898
```
99-
$ pip install tern
99+
pip install tern
100100
```
101101

102102
Run Tern:
103103
```
104-
$ tern report -o output.txt -i debian:buster
104+
tern report -o output.txt -i debian:buster
105105
```
106106

107107
## Getting Started with Docker<a name="getting-started-with-docker">
108108
Docker is the most widely used tool to build and run containers. If you already have Docker installed, you can run Tern by building a container with the Dockerfile provided.
109109

110110
Clone this repository:
111111
```
112-
$ git clone https://github.com/tern-tools/tern.git
112+
git clone https://github.com/tern-tools/tern.git
113113
```
114114

115115
Build the Docker image (called `ternd` here). You may need to use sudo:
116116
```
117-
$ docker build -f docker/Dockerfile -t ternd .
117+
docker build -f docker/Dockerfile -t ternd .
118118
```
119119

120120
This will install the latest release of tern using pip.
121121

122122
If you want to build a Docker image containing the latest changes to tern, run:
123123
```
124-
$ python setup.py sdist
125-
$ docker build -f ci/Dockerfile -t ternd .
124+
python setup.py sdist
125+
docker build -f ci/Dockerfile -t ternd .
126126
```
127127

128128
**NOTE**: By default, Tern will run with logging turned on. If you would like to silent the terminal output when running the ternd container, make the following change to the Dockerfile ENTRYPOINT before building:
@@ -137,18 +137,18 @@ $ docker build -f ci/Dockerfile -t ternd .
137137
Run the ternd container image
138138

139139
```
140-
$ docker run --rm ternd report -i debian:buster
140+
docker run --rm ternd report -i debian:buster
141141
```
142142

143143
If you are using this container to analyze Dockerfiles and to use the "lock" feature, then you must volume mount the docker socket. We have a convenience script which will do that for you.
144144

145145
```
146-
$ ./docker_run.sh ternd "report -i debian:buster" > output.txt
146+
./docker_run.sh ternd "report -i debian:buster" > output.txt
147147
```
148148

149149
To produce a json report run
150150
```
151-
$ ./docker_run.sh ternd "report -f json -i debian:buster"
151+
./docker_run.sh ternd "report -f json -i debian:buster"
152152
```
153153

154154
Tern is not distributed as Docker images yet. This is coming soon. Watch the [Project Status](#project-status) for updates.
@@ -168,17 +168,17 @@ To install minikube, follow [these instructions](https://minikube.sigs.k8s.io/do
168168

169169
Download the existing Tern Dockerfile
170170
```
171-
$ wget https://raw.githubusercontent.com/tern-tools/tern/main/docker/Dockerfile
171+
wget https://raw.githubusercontent.com/tern-tools/tern/main/docker/Dockerfile
172172
```
173173

174174
Start minikube
175175
```
176-
$ minikube start --driver=virtualbox
176+
minikube start --driver=virtualbox
177177
```
178178

179179
Use minikube to build the Tern container image
180180
```
181-
$ minikube image build -t tern:test -f Dockerfile .
181+
minikube image build -t tern:test -f Dockerfile .
182182
```
183183

184184
Once build has completed, you should see the image by running `minikube image ls`. It should look something like `docker.io/library/tern:test`.
@@ -210,7 +210,7 @@ spec:
210210

211211
We can now deploy Tern on Kubernetes
212212
```
213-
$ minikube kubectl -- apply -f tern-example.yaml
213+
minikube kubectl -- apply -f tern-example.yaml
214214
```
215215

216216
To check the status of the Job, you can run `minikube kubectl -- describe job.batch/tern`. You should be able to see `report.txt` in `/path/to/tern/reports/`.
@@ -230,23 +230,23 @@ In your terminal app, run the following commands.
230230

231231
Clone this repository:
232232
```
233-
$ git clone https://github.com/tern-tools/tern.git
233+
git clone https://github.com/tern-tools/tern.git
234234
```
235235

236236
Bring up the Vagrant box:
237237
```
238-
$ cd tern/vagrant
239-
$ vagrant up
238+
cd tern/vagrant
239+
vagrant up
240240
```
241241

242242
SSH into the created VM:
243243
```
244-
$ vagrant ssh
244+
vagrant ssh
245245
```
246246

247247
Run:
248248
```
249-
$ tern report -i debian:buster -o output.txt
249+
tern report -i debian:buster -o output.txt
250250
```
251251

252252
# Using Tern<a name="using-tern">
@@ -258,25 +258,25 @@ Tern creates a report containing the Software Bill of Materials (SBOM) of a cont
258258
## Generating an SBOM report for a Docker image<a name="sbom-for-docker-image">
259259
If you have a Docker image pulled locally and want to inspect it
260260
```
261-
$ tern report -i debian:jessie
261+
tern report -i debian:jessie
262262
```
263263
The SBOM of packages that are installed in the Docker image and how Tern got this information will be printed to the console. To direct this output to a file, use the `-o file_name` command line option. If you encounter any errors, please file an issue.
264264

265265
## Generating an SBOM report from a Dockerfile<a name="sbom-for-dockerfile">
266266
You can provide a Dockerfile to Tern to figure out the Software Bill of Materials and other information. Tern will build the image, analyze it with respect to the Dockerfile and discard the image. This is useful to engineers who are developing a Dockerfile for their app or in a container build and release pipeline.
267267
```
268-
$ tern report -d samples/photon_git/Dockerfile
268+
tern report -d samples/photon_git/Dockerfile
269269
```
270270
The SBOM of packages you would be shipping if you were to use the given Dockerfile will print to the console. To direct the output to a file, use the `-o file_name` command line option. Feel free to try this out on the other sample Dockerfiles in the samples directory or on Dockerfiles you may be working with. If it doesn't work for you, please file an issue.
271271

272272
## Generating a locked Dockerfile<a name="dockerfile-lock">
273273
Because of the way Docker builds containers, Dockerfiles are generally not declarative or reflective of what ultimately gets included in the container image that gets produced. Pinning information in your Dockerfile (base OS, packages, etc.) can help create more reproducible container images should your Dockerfile be distributed to other parties. If you have a Dockerfile that you would like to lock to a more reproducible version, Tern can help.
274274
```
275-
$ tern lock Dockerfile
275+
tern lock Dockerfile
276276
```
277277
The locked Dockerfile will be created in `Dockerfile.lock` unless an output file is otherwise specified. To specify an output file
278278
```
279-
$ tern lock Dockerfile -o output.txt
279+
tern lock Dockerfile -o output.txt
280280
```
281281
If the packages are not pinned in the resulting `Dockerfile.lock` or output file that gets produced, it is because 1) Tern does not know the version of the packages to pin (i.e. unable to get this information from the package manager) or 2) your Dockerfile failed to build. In the case of a failed Dockerfile build, Tern only builds the base image and tries to pin what it can. If you encounter any errors, please file an issue.
282282

@@ -295,49 +295,49 @@ The default report Tern produces is a human readable, high-level overview. The o
295295

296296
While the packages found in each layer and their associated version and license are listed on a per layer basis, there is also a summary of licenses found in the container printed at the bottom of the report which is unique to the default human readable format.
297297
```
298-
$ tern report -i golang:1.12-alpine -o output.txt
298+
tern report -i golang:1.12-alpine -o output.txt
299299
```
300300

301301
## JSON Format<a name="report-json">
302302
You can get the results in a JSON file to pass around in a network. The JSON report contains the most amount of container metadata compared to the default report and because of this, is often a very large file. If you are planning to look for information in this file manually, we recommend using the `jq` utility to better display and understand the information in the report.
303303

304304
In terms of general container information, the JSON report provides detailed "created by" information including docker container config information, layer `created_by` information and layer creation time stamps. It also provides the `diff_id` and tar file information for each layer, including each layer's unique package set and the packages metadata. The JSON report will also provide more detailed package metadata (if found) including the project URL information, files found in each package when run with scancode and package licenses (`pkg_licenses`) for containers based on Debian OSes where license information is parsed from Copyright text instead of declared by the package manager (`pkg_license`).
305305
```
306-
$ tern report -f json -i golang:1.12-alpine
306+
tern report -f json -i golang:1.12-alpine
307307
```
308308

309309
## HTML Format<a name="report-html">
310310
You can get an html rendering of the JSON results. An output file with `.html` suffix should be provided in order to properly view the report in your browser. The HTML report will include all of the same information found in a JSON report. See above for details about the JSON report.
311311
```
312-
$ tern report -f html -i golang:1.12-alpine -o report.html
312+
tern report -f html -i golang:1.12-alpine -o report.html
313313
```
314314

315315
## YAML Format<a name="report-yaml">
316316
You can get the results in a YAML file to be consumed by a downstream tool or script. The YAML information will be the same information found in the JSON report. See above for details about the JSON report.
317317
```
318-
$ tern report -f yaml -i golang:1.12-alpine -o output.yaml
318+
tern report -f yaml -i golang:1.12-alpine -o output.yaml
319319
```
320320

321321
## SPDX tag-value Format<a name="report-spdxtagvalue">
322322
[SPDX](https://spdx.org/) is a format developed by the Linux Foundation to provide a standard way of reporting license information. It is now an [ISO standard](https://www.iso.org/standard/81870.html). The National Telecommunications and Information Administration (NTIA) [recognizes SPDX](https://www.ntia.gov/files/ntia/publications/sbom_options_and_decision_points_20210427-1.pdf) as one of three valid SBOM formats that satisfies the minimum viable requirements for an SBOM in accordance with President Biden's [Executive Order on Improving the Nation's Cybersecurity](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/).
323323

324324
Many compliance tools are compatible with SPDX. Tern follows the [SPDX specifications](https://spdx.org/specifications). The tag-value format is most compatible with the toolkit the organization provides. There are conversion tools available [here](https://github.com/spdx/tools) (some still in development). You can read an overview of the SPDX tag-value specification [here](./docs/spdx-tag-value-overview) and about how Tern maps its properties to the keys mandated by the spec [here](./docs/spdx-tag-value-mapping.md).
325325
```
326-
$ tern report -f spdxtagvalue -i golang:1.12-alpine -o spdx.txt
326+
tern report -f spdxtagvalue -i golang:1.12-alpine -o spdx.txt
327327
```
328328

329329
## SPDX JSON Format<a name="report-spdxjson">
330330
The SPDX JSON format contains the same information that an SPDX Tag-value document does. The only difference between these two formats is the way the information is represented. The 'spdxjson' format represents the container information as a collection of key-value pairs. In some cases, the SPDX JSON format may be more interoperable between cloud native compliance tools.
331331
```
332-
$ tern report -f spdxjson -i golang:1.12-alpine -o spdx.json
332+
tern report -f spdxjson -i golang:1.12-alpine -o spdx.json
333333
```
334334

335335
## CycloneDX JSON Format<a name="report-cyclonedxjson">
336336
[OWASP CycloneDX](https://cyclonedx.org/) is a lightweight software bill of materials standard designed for use in application security contexts and supply chain component analysis. The National Telecommunications and Information Administration (NTIA) [recognizes CycloneDX](https://www.ntia.gov/files/ntia/publications/sbom_options_and_decision_points_20210427-1.pdf) as one of three valid SBOM formats that satisfies the minimum viable requirements for an SBOM in accordance with President Biden's [Executive Order on Improving the Nation's Cybersecurity](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/).
337337

338338
Many tools for producing and consuming CycloneDX SBOMs are listed in the [CycloneDX Tool Center](https://cyclonedx.org/tool-center/).
339339
```
340-
$ tern report -f cyclonedxjson -i golang:1.12-alpine -o bom.json
340+
tern report -f cyclonedxjson -i golang:1.12-alpine -o bom.json
341341
```
342342

343343
# Extensions<a name="extensions">
@@ -354,21 +354,21 @@ NOTE: Neither the Docker container nor the Vagrant image has any of the extensio
354354

355355
2. Setup a python virtual environment
356356
```
357-
$ python3 -m venv scanenv
358-
$ cd scanenv
359-
$ source bin/activate
357+
python3 -m venv scanenv
358+
cd scanenv
359+
source bin/activate
360360
```
361361
3. Install tern and scancode
362362
```
363-
$ pip install tern scancode-toolkit
363+
pip install tern scancode-toolkit
364364
```
365365
<br> If you are using macOS on M1 or Linux on ARM, run:</br>
366366
```
367-
$ pip install tern scancode-toolkit-mini
367+
pip install tern scancode-toolkit-mini
368368
```
369369
4. Run tern with scancode
370370
```
371-
$ tern report -x scancode -i golang:1.12-alpine
371+
tern report -x scancode -i golang:1.12-alpine
372372
```
373373

374374
If you are running Scancode for the first time, depending on the size of the container image, it takes anywhere between 10 minutes to a few hours to run due to the number of files needed to be analyzed. Once completed, subsequent runs will be much faster as the data will be cached for future use.
@@ -380,23 +380,23 @@ If you are running Scancode for the first time, depending on the size of the con
380380

381381
2. Setup a python virtual environment
382382
```
383-
$ python3 -m venv scanenv
384-
$ cd scanenv
385-
$ source bin/activate
383+
python3 -m venv scanenv
384+
cd scanenv
385+
source bin/activate
386386
```
387387
3. Install tern and cve-bin-tool
388388
```
389-
$ pip install tern cve-bin-tool
389+
pip install tern cve-bin-tool
390390
```
391391
4. Run tern with cve-bin-tool
392392
```
393-
$ tern report -x cve_bin_tool -i golang:1.12-alpine
393+
tern report -x cve_bin_tool -i golang:1.12-alpine
394394
```
395395

396396
# Running tests<a name="running-tests">
397397
WARNING: The `test_util_*` tests are not up to date. We are working on it :). From the Tern repository root directory run:
398398
```
399-
$ python tests/<test file>.py
399+
python tests/<test file>.py
400400
```
401401

402402
## Project Status<a name="project-status"/>

0 commit comments

Comments
 (0)