Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
tag_name: ${{ steps.version.outputs.version }}
name: Release ${{ steps.version.outputs.version }}
body: |
## SBOM Generator ${{ steps.version.outputs.version }}
## BomLens ${{ steps.version.outputs.version }}

Generate a CycloneDX SBOM, an open-source notice (고지문), and a security report from your source code — or assess the open-source risk of an SBOM or firmware you receive.

Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **한국어**: [CONTRIBUTING.md](CONTRIBUTING.md)

Thanks for your interest in SBOM Generator! Contributions of any kind are welcome — bug fixes, documentation improvements, new language support, and more.
Thanks for your interest in BomLens! Contributions of any kind are welcome — bug fixes, documentation improvements, new language support, and more.

> **Related**: [Architecture](docs/internal/architecture.md) | [Testing guide](docs/contributing/testing-guide.md) | [Adding a package manager](docs/contributing/package-manager-guide.md)

Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **English**: [CONTRIBUTING.en.md](CONTRIBUTING.en.md)

SBOM Generator 프로젝트에 관심 가져 주셔서 감사합니다! 버그 수정, 문서 개선, 새로운 언어 지원 추가 등 어떤 형태의 기여든 환영합니다.
BomLens 프로젝트에 관심 가져 주셔서 감사합니다! 버그 수정, 문서 개선, 새로운 언어 지원 추가 등 어떤 형태의 기여든 환영합니다.

> **관련 문서**: [아키텍처](docs/internal/architecture.md) | [테스트 가이드](docs/contributing/testing-guide.md) | [패키지 매니저 추가](docs/contributing/package-manager-guide.md)

Expand Down
12 changes: 6 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# SBOM Generator
# BomLens

> Automated SBOM (CycloneDX 1.6) generation for supply chain security
> A local-first SBOM generator and open-source risk assessor — scan a single project in seconds, no SaaS.

[![GitHub release](https://img.shields.io/github/v/release/sktelecom/sbom-tools?style=flat-square)](https://github.com/sktelecom/sbom-tools/releases)
[![Container image](https://img.shields.io/badge/ghcr.io-sbom--generator-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/sktelecom/sbom-tools/pkgs/container/sbom-generator)
Expand All @@ -10,7 +10,7 @@

**Where to start:**

- **Using the tool** — generate an SBOM, an open-source notice, or a security report, or assess a binary or an SBOM you received. Start with [Getting started](docs/getting-started.en.md) ([한국어](docs/getting-started.md)). On Windows and prefer no command line? [Download SBOM Generator for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click — the [no-CLI quick start](docs/quickstart-no-cli.md) (Korean) walks through it.
- **Using the tool** — generate an SBOM, an open-source notice, or a security report, or assess a binary or an SBOM you received. Start with [Getting started](docs/getting-started.en.md) ([한국어](docs/getting-started.md)). On Windows and prefer no command line? [Download BomLens for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click — the [no-CLI quick start](docs/quickstart-no-cli.md) (Korean) walks through it.
- **Contributing to the tool itself** — building the image, the pipeline internals, or adding a package manager? See [CONTRIBUTING](CONTRIBUTING.en.md) and the [architecture](docs/internal/architecture.md).

A Docker engine is required either way; the free [Rancher Desktop](https://rancherdesktop.io/) works well on Windows.
Expand All @@ -24,7 +24,7 @@ Every scan also emits the risk report by default. Run it from the CLI or a brows

Languages: Java, Python, Node.js, Ruby, PHP, Rust, Go, .NET, C/C++ (Conan/vcpkg). Inputs: source folder, GitHub URL, ZIP archive, Docker image, binary/RootFS, existing SBOM, firmware.

![SBOM Generator web UI — name a project, pick a scan target, and choose what to generate (SBOM, open-source notice, security report)](docs/images/web-ui-en.png)
![BomLens web UI — name a project, pick a scan target, and choose what to generate (SBOM, open-source notice, security report)](docs/images/web-ui-en.png)

## Quick Start

Expand All @@ -41,7 +41,7 @@ No git installed? Download the repo as a ZIP from the GitHub page (the green Cod

Launch, scan, and download — all in the browser. Live logs stream as it runs.

![SBOM Generator web UI — a scan in progress with live logs](docs/images/web-ui-scan-en.png)
![BomLens web UI — a scan in progress with live logs](docs/images/web-ui-scan-en.png)

```bash
cd ~/sbom-output # any folder — this is where results are saved
Expand All @@ -65,7 +65,7 @@ The [getting-started guide](docs/getting-started.md) covers this in more detail

Prefer a real app over a `.bat`? A desktop app wraps this same flow with no console window — it checks Docker, pulls the image, and opens the UI on double-click. Download `SBOM-Generator-*.exe` (or `.dmg`) from the [latest release](https://github.com/sktelecom/sbom-tools/releases/latest). It is unsigned for now, so if Windows SmartScreen warns, click **More info** and then **Run anyway**. Build details are in [`electron/`](electron/README.md).

![SBOM Generator desktop app — the startup screen shows Docker checks, image download progress, and container startup](docs/images/desktop-startup-en.png)
![BomLens desktop app — the startup screen shows Docker checks, image download progress, and container startup](docs/images/desktop-startup-en.png)

### CLI

Expand Down
2 changes: 1 addition & 1 deletion SECURITY.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **한국어**: [SECURITY.md](SECURITY.md)

SBOM Generator is a software supply-chain security tool, so the security of the tool itself matters too. If you find a vulnerability, please report it responsibly.
BomLens is a software supply-chain security tool, so the security of the tool itself matters too. If you find a vulnerability, please report it responsibly.

## Supported versions

Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **English**: [SECURITY.en.md](SECURITY.en.md)

SBOM Generator는 소프트웨어 공급망 보안을 다루는 도구인 만큼, 도구 자체의 보안도
BomLens는 소프트웨어 공급망 보안을 다루는 도구인 만큼, 도구 자체의 보안도
중요하게 여긴다. 취약점을 발견했다면 책임 있는 절차에 따라 알려 주기를 부탁한다.

## 지원 버전 (Supported Versions)
Expand Down
2 changes: 1 addition & 1 deletion SUPPORT.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Support

Thanks for using SBOM Generator. Here is where to go for help.
Thanks for using BomLens. Here is where to go for help.

## Documentation first

Expand Down
4 changes: 2 additions & 2 deletions docker/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ========================================================
# SBOM Generator — post-processing image (2-stage architecture)
# BomLens — post-processing image (2-stage architecture)
# Image: ghcr.io/sktelecom/sbom-scanner
#
# In the redesigned pipeline (see docs/direction-study.md), SBOM GENERATION for
Expand Down Expand Up @@ -27,7 +27,7 @@
# firmware tools (pinned) do not yet support newer Python, so we stay on 3.12.
FROM python:3.12-slim@sha256:a39549e211a16149edf74e5fdc9ef03a6767e46cd987c5048b6659b6c9904c94

LABEL org.opencontainers.image.title="SBOM Generator (post-process)"
LABEL org.opencontainers.image.title="BomLens (post-process)"
LABEL org.opencontainers.image.description="syft + Trivy + notice + signing + UI; SBOM generation delegated to cdxgen language images"
LABEL org.opencontainers.image.vendor="SK Telecom"
LABEL org.opencontainers.image.licenses="Apache-2.0"
Expand Down Expand Up @@ -55,12 +55,12 @@
# jq (helper scripts), curl/tar (installers), file (binary mode),
# git (web UI 'GitHub URL' ingestion: server.py clones into a temp source tree).
# python3 + pip are already in the python:3.12-slim base (web UI + scancode).
RUN apt-get update && apt-get install -y --no-install-recommends \

Check failure on line 58 in docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint Scripts

DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
jq curl wget ca-certificates bash tar file git \
&& rm -rf /var/lib/apt/lists/*

# syft — image/binary/RootFS scanning (pinned)
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \

Check failure on line 63 in docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint Scripts

DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
| sh -s -- -b /usr/local/bin "${SYFT_VERSION}" \
&& syft version

Expand Down Expand Up @@ -114,7 +114,7 @@
# NOTE: the PyPI `binwalk` 2.x dist is broken (no binwalk.core), so it is NOT
# installed; unsquashfs covers the common squashfs case. vendor-modified
# (non-standard) squashfs still needs sasquatch added on top of this.
RUN if [ "$SBOM_FIRMWARE" = "true" ]; then \

Check failure on line 117 in docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint Scripts

DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
apt-get update && apt-get install -y --no-install-recommends \
squashfs-tools e2fsprogs p7zip-full unar cpio cabextract \
lzop zstd lz4 liblzo2-2 zlib1g \
Expand Down
4 changes: 2 additions & 2 deletions docker/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Docker 이미지 가이드

SKT SBOM Generator Docker 이미지 빌드, 배포 및 사용 가이드입니다.
SKT BomLens Docker 이미지 빌드, 배포 및 사용 가이드입니다.

## 목차

Expand All @@ -13,7 +13,7 @@ SKT SBOM Generator Docker 이미지 빌드, 배포 및 사용 가이드입니다

## 개요

SBOM Generator는 다음 환경을 포함한 Docker 이미지로 제공됩니다:
BomLens는 다음 환경을 포함한 Docker 이미지로 제공됩니다:

### 포함된 도구 및 런타임

Expand Down
4 changes: 2 additions & 2 deletions docker/android/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ========================================================
# SBOM Generator — Android SDK image (per compileSdk)
# BomLens — Android SDK image (per compileSdk)
# Image: ghcr.io/sktelecom/sbom-scanner-android-sdk<ANDROID_API>
#
# cdxgen does NOT provide Android-SDK-bundled images and marks Android as
Expand All @@ -19,7 +19,7 @@ ARG ANDROID_API=35
ARG ANDROID_BUILD_TOOLS=${ANDROID_API}.0.0
ARG CMDLINE_TOOLS=11076708

LABEL org.opencontainers.image.title="SBOM Generator Android SDK"
LABEL org.opencontainers.image.title="BomLens Android SDK"
LABEL org.opencontainers.image.vendor="SK Telecom"
LABEL org.opencontainers.image.licenses="Apache-2.0"

Expand Down
2 changes: 1 addition & 1 deletion docs/contributing/testing-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **관련 문서**: [기여 가이드](../../CONTRIBUTING.md) | [아키텍처](../internal/architecture.md) | [패키지 매니저 추가](package-manager-guide.md)

SBOM Generator의 테스트 구조, 실행 방법, 테스트 작성 방법 및 디버깅 절차를 설명합니다.
BomLens의 테스트 구조, 실행 방법, 테스트 작성 방법 및 디버깅 절차를 설명합니다.

## 목차

Expand Down
2 changes: 1 addition & 1 deletion docs/getting-started.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Docker Desktop is the simplest, but it needs a paid license above a certain orga

### Windows — download and double-click (no command line)

The simplest path is the desktop app. Use [Download SBOM Generator for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click the file; the UI opens with no console window. It is unsigned for now, so if Windows SmartScreen warns, click **More info** and then **Run anyway**. A step-by-step Korean guide is in the [no-CLI quickstart](quickstart-no-cli.md).
The simplest path is the desktop app. Use [Download BomLens for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click the file; the UI opens with no console window. It is unsigned for now, so if Windows SmartScreen warns, click **More info** and then **Run anyway**. A step-by-step Korean guide is in the [no-CLI quickstart](quickstart-no-cli.md).

Prefer scripts? Download the repo ZIP (the green Code button, then Download ZIP), unzip it, and double-click `scripts\sbom-ui.bat`. The scanner image (about 3–4 GB) downloads automatically on first run.

Expand Down
6 changes: 3 additions & 3 deletions docs/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **관련 문서**: [사용 가이드](usage-guide.md) | [예제 가이드](examples-guide.md) | [시나리오 가이드](scenarios-guide.md)

SBOM Generator를 처음 사용하는 분을 위한 설치부터 첫 번째 SBOM 생성까지의 단계별 가이드입니다.
BomLens를 처음 사용하는 분을 위한 설치부터 첫 번째 SBOM 생성까지의 단계별 가이드입니다.

> 명령어 없이 SBOM이나 고지문만 빨리 만들고 싶다면
> [비개발자 빠른 시작](quickstart-no-cli.md)부터 보세요.
Expand Down Expand Up @@ -55,7 +55,7 @@ Windows에서 웹 UI만 쓴다면(Rancher Desktop/Docker Desktop) 추가 도구

### Windows — 다운로드 후 더블클릭 (명령줄 불필요)

가장 간단한 길은 데스크톱 앱입니다. [Windows용 SBOM Generator 내려받기 (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe)를 눌러 받은 파일을 더블클릭하면 콘솔 창 없이 UI가 열립니다. 아직 미서명이라 SmartScreen 경고가 뜨면 "추가 정보"를 누르고 "실행"을 고릅니다. 단계별 안내는 [비개발자 빠른 시작](quickstart-no-cli.md)을 참고하세요.
가장 간단한 길은 데스크톱 앱입니다. [Windows용 BomLens 내려받기 (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe)를 눌러 받은 파일을 더블클릭하면 콘솔 창 없이 UI가 열립니다. 아직 미서명이라 SmartScreen 경고가 뜨면 "추가 정보"를 누르고 "실행"을 고릅니다. 단계별 안내는 [비개발자 빠른 시작](quickstart-no-cli.md)을 참고하세요.

![데스크톱 앱 시작 화면 — Docker 점검과 이미지 다운로드, 컨테이너 준비 상황을 보여준다](images/desktop-startup.png)

Expand Down Expand Up @@ -123,7 +123,7 @@ Windows에서는(Rancher Desktop/Docker Desktop) `scripts\sbom-ui.bat`를 더블

### 스캔

![SBOM Generator 웹 UI](images/web-ui.png)
![BomLens 웹 UI](images/web-ui.png)

1. 프로젝트 이름과 버전을 입력합니다.
2. 스캔 대상을 고릅니다. 현재 폴더, GitHub URL, ZIP 업로드, SBOM 업로드, 펌웨어 업로드, Docker 이미지 중에서 선택할 수 있습니다.
Expand Down
4 changes: 2 additions & 2 deletions docs/index.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ hide:
- toc
---

# SBOM Generator
# BomLens

Automated SBOM (CycloneDX 1.6) generation for software supply chain security. From source code, a container image, a binary, or an SBOM you received, it produces an SBOM, an open-source notice, and a security risk report in one run.
A local-first SBOM generator and open-source risk assessor for a single project — no SaaS, no account. From source code, a container image, a binary, or an SBOM you received, it produces an SBOM (CycloneDX 1.6), an open-source notice, and a security risk report in one run.

[Download for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe){ .md-button .md-button--primary }
[Get started](getting-started.md){ .md-button }
Expand Down
4 changes: 2 additions & 2 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ hide:
- toc
---

# SBOM Generator
# BomLens

소프트웨어 공급망 보안을 위한 SBOM(CycloneDX 1.6) 자동 생성 도구입니다. 소스 코드나 컨테이너 이미지, 바이너리, 받은 SBOM에서 SBOM과 오픈소스 고지문, 보안 위험 보고서를 한 번에 만듭니다.
SaaS 없이 로컬에서 단일 프로젝트의 SBOM(CycloneDX 1.6)을 생성하고 오픈소스 리스크를 평가하는 도구입니다. 소스 코드나 컨테이너 이미지, 바이너리, 받은 SBOM에서 SBOM과 오픈소스 고지문, 보안 위험 보고서를 한 번에 만듭니다.

[Windows용 내려받기 (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe){ .md-button .md-button--primary }
[시작하기](getting-started.md){ .md-button }
Expand Down
6 changes: 3 additions & 3 deletions docs/internal/architecture.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> **관련 문서**: [시작하기](../getting-started.md) · [고지문·보안·UI 가이드](../notice-and-security.md) · [방향성 조사 보고서](direction-study.md) · [기여 가이드](../../CONTRIBUTING.md) · [패키지 매니저 추가](../contributing/package-manager-guide.md)

SBOM Generator의 전체 시스템 구조와, 스캔 파이프라인에서 각 도구가 어느 단계에서 어떤 순서로 호출되는지 설명합니다.
BomLens의 전체 시스템 구조와, 스캔 파이프라인에서 각 도구가 어느 단계에서 어떤 순서로 호출되는지 설명합니다.

> 이 문서는 현재 구현된 2단계(2-stage) 아키텍처를 기준으로 작성되었습니다. 소스 코드의 Stage 1 라우팅(언어 감지 후 cdxgen 공식 언어 이미지 실행)은 `scripts/scan-sbom.sh`에 구현되어 동작합니다.

Expand All @@ -25,7 +25,7 @@ SBOM Generator의 전체 시스템 구조와, 스캔 파이프라인에서 각

## 한눈에 보기

SBOM Generator는 두 종류의 Docker 이미지가 협력하는 2단계 파이프라인입니다.
BomLens는 두 종류의 Docker 이미지가 협력하는 2단계 파이프라인입니다.

- **Stage 1 — 생성**: 소스 코드는 cdxgen 언어별 공식 이미지가, 컨테이너 이미지·바이너리·디렉터리는 syft가 SBOM(CycloneDX 1.6)을 만듭니다.
- **Stage 2 — 후처리**: 경량 `sbom-scanner` 이미지가 SBOM을 받아 정규화, (정밀 라이선스), 고지문, 보안 보고서, 서명, 업로드를 차례로 수행합니다.
Expand Down Expand Up @@ -380,7 +380,7 @@ CLI 플래그가 어떤 환경변수로 변환되어 어느 단계를 켜는지

## 역할 분담 (trustedoss-portal)

SBOM Generator는 **생성(generation)** 전문 도구입니다. 전사(全社) 프로젝트 관리·취약점 triage·라이선스 정책 게이트 같은 **거버넌스**는 자매 프로젝트 [`trustedoss-portal`](https://github.com/sktelecom/trustedoss-portal)에 위임합니다. 두 도구 모두 cdxgen/Trivy를 공유하므로 산출물(CycloneDX)이 그대로 호환됩니다.
BomLens는 **생성(generation)** 전문 도구입니다. 전사(全社) 프로젝트 관리·취약점 triage·라이선스 정책 게이트 같은 **거버넌스**는 자매 프로젝트 [`trustedoss-portal`](https://github.com/sktelecom/trustedoss-portal)에 위임합니다. 두 도구 모두 cdxgen/Trivy를 공유하므로 산출물(CycloneDX)이 그대로 호환됩니다.

```mermaid
flowchart LR
Expand Down
2 changes: 1 addition & 1 deletion docs/internal/improvement-roadmap.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# SBOM Generator 개선 로드맵
# BomLens 개선 로드맵

이 문서는 실제 스캔 결과에서 드러난 미비점을 정리하고, 오픈소스 거버넌스 포털(trustedoss-portal)을 참고 기준으로 삼아 개선 항목과 우선순위를 도출한다. 웹 UI의 스캔 엔진 문제는 이미 해결했고(아래 1항), UI 가시성과 리포트 충실도는 남은 과제다.

Expand Down
2 changes: 1 addition & 1 deletion docs/notice-and-security.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ The private key is mounted read-only into the container. Additional output: `MyA

Scan from a browser without the CLI. The UI server is built into the scanner image, so no extra install is needed.

![The SBOM Generator web UI](images/web-ui.png)
![The BomLens web UI](images/web-ui.png)

**macOS / Linux:**
```bash
Expand Down
2 changes: 1 addition & 1 deletion docs/notice-and-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ docker run --rm -v "$PWD":/w -w /w --entrypoint cosign \

CLI 없이 브라우저에서 스캔합니다. UI 서버는 스캐너 이미지에 내장되어 있어 추가 설치가 필요 없습니다.

![SBOM Generator 웹 UI](images/web-ui.png)
![BomLens 웹 UI](images/web-ui.png)

**macOS / Linux:**
```bash
Expand Down
4 changes: 2 additions & 2 deletions docs/quickstart-no-cli.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ flowchart TD
### Path A — desktop app (recommended)

1. **Install a Docker engine**. Download the Windows installer from [rancherdesktop.io](https://rancherdesktop.io/), install it, and run it. If it asks whether to use Kubernetes during install, you can turn it off. When the taskbar icon settles (usually 1–2 minutes), it is ready.
2. **Get and run the app**. Click [Download SBOM Generator for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click the file. It is unsigned for now, so if Windows shows a "Windows protected your PC" warning, click "More info" and choose "Run anyway". The app opens with no console window.
2. **Get and run the app**. Click [Download BomLens for Windows (.exe)](https://github.com/sktelecom/sbom-tools/releases/latest/download/SBOM-Generator-Setup.exe) and double-click the file. It is unsigned for now, so if Windows shows a "Windows protected your PC" warning, click "More info" and choose "Run anyway". The app opens with no console window.
3. **First-run image download**. The scanner image is pulled just once. The app shows progress as below, so leave the window open and wait.

![Click "More info" on the SmartScreen warning and proceed with "Run anyway"](images/smartscreen.png)
Expand All @@ -68,7 +68,7 @@ To check that everything is ready, double-click `scripts\check-setup.bat` in the

![The console window on the first run of sbom-ui.bat, showing the image download notice](images/bat-console.png)

![The SBOM Generator web UI](images/web-ui.png)
![The BomLens web UI](images/web-ui.png)

## Scan and get the notice

Expand Down
Loading
Loading