Server
This chapter is aimed solely at system admins. It contains instructions on how to get the BOMnipotent server up and running, and how to configure it to your needs.
Subsections of BOMnipotent
Subsections of Server
Initial Setup
This section aims to make setting up your server to host an instance of BOMnipotent Server as easy as possible.
The setup consists of the following, necessary steps:
After that you can configure the server to your personal needs.
Subsections of Initial Setup
Starting the Server
Several setup variants are presented here. You can pick the one best suited to your needs, and modify it at will. If you do not know where to start, the setup via docker compose is an excellent choice.
After following the steps of one of the variants, your server has a default configuration and should be reachable from the internet. After that, you should create an admin user account .
Subsections of Starting the Server
Docker Compose
The recommended and easiest setup for BOMnipotent Server uses docker compose .
Suggested File Structure
The suggested file structure in the favourite directory of your server looks like this:
├── .env
├── bomnipotent_config
│  ├── config.toml
│  └── config.toml.default
└── compose.yamlThis tutorial will walk through the files and explain them one by one.
.env
BOMnipotent server communicates with a database. Currently, only PostgreSQL is supported as a backend. The database is protected by a password. It is best practice to store the password inside a separate .env file instead of directly in the compose.yaml.
The name of the file must be “.env”, otherwise docker will not recognise it.
Your .env file should look like this:
BOMNIPOTENT_DB_PW=<your-database-password>If you are using a versioning system to store your setup, do not forget to add “.env” to your .gitignore or analogous ignore file!
To put the security into perspective: The compose file will not directly expose the PostgreSQL container to the internet. The password is therefore only used for calls within the container network.
config.toml
BOMnipotent Server needs a configuration file, which is explained in more detail in another section .
The name of the file is arbitrary in principle, but the ready-to-deploy BOMnipotent Server docker container is set up to look for “config.toml”.
A minimal configuration looks like this:
# The db_url has the structure [db_client]://[user]:[password]@[container]:[port]/[db]
# Note that ${BOMNIPOTENT_DB_PW} references an environment variable.
db_url = "postgres://bomnipotent_user:${BOMNIPOTENT_DB_PW}@bomnipotent_db:5432/bomnipotent_db"
# Domain behind which bomnipotent server will be hosted
domain = "https://<your-domain>.<top-level>"
[tls]
# The path to your full TLS certificate chain
certificate_chain_path = "/etc/ssl/certs/<your-TLS-certificate-chain.crt>"
# The path to your secret TLS key
secret_key_path = "/etc/ssl/private/<your-secret-TLS-key>"
# Publisher data according to the CSAF Standard linked below
[provider_metadata.publisher]
name = "<Provide the name of your organsiation>"
# Namespace of your organisation, in form of a complete URL
namespace = "https://<your-domain>.<top-level>"
# This is most likely the enum variant you want
category = "vendor"
# Contact details are optional and in free form
contact_details = "<For security inquiries, please contact us at...>"Fill in the braces with your data.
The section about TLS configuration contains more detailed information to avoid common pitfalls.
The publisher data is used to comply with the OASIS CSAF standard .
The section about provider-metadata goes into more details what the fields actually mean.
It is recommended to store your config.toml file inside a dedicated directory, “bomnipotent_config” in this example. The docker compose file will grant read access to this folder. This setup has two advantages:
- In the unlikely case of a security breach of the BOMnipotent Server container, an attacker would only have access to you config directory, and nothing else on your server.
- BOMnipotent Server will watch the directory for changes and will try to reload the configuration file if it has changed. This does not work when exposing only a single file to the docker container.
Many configuration values support hot reloading, meaning they can be modified without restarting the server.
After having set up your config.toml, you may want to copy it as for example config.toml.default, to be able to quickly restore your initial configuration. This is entirely optional, though.
compose.yaml
The compose file is where you specify the container setup. Once it is running smoothly, it does not need to be modified very often, but initially understanding it can take some time if you are new to docker.
The file needs to be called “compose.yaml”, docker can be a bit pecky otherwise.
A completely ready to deploy compose file looks like this:
# Giving the setup a name is optional, it will be derived by docker otherwise.
name: bomnipotent_server_containers
# The docker containers need to communicate, and they need a network for that.
networks:
# This network needs a reference
bomnipotent_network:
# Since the containers are on the same docker host, "bridge" is a reasonable driver choice.
driver: bridge
# Giving the network the same name as the reference is ok.
name: bomnipotent_network
volumes:
# Define the volume for persistent storage of the database
bomnipotent_data:
driver: local
# The server itself also needs persistence if you do not want to activate the subscription after every reboot
bomnipotent_subscription:
driver: local
services:
bomnipotent_db:
# Name of the database container
container_name: bomnipotent_db
deploy:
resources:
limits:
# Limit the CPU usage to 0.5 cores
cpus: "0.5"
# Limit the memory usage to 512MB
memory: "512M"
environment:
# Set the database name
POSTGRES_DB: bomnipotent_db
# Set the database user
POSTGRES_USER: bomnipotent_user
# Set the database password from the .env file variable
POSTGRES_PASSWORD: ${BOMNIPOTENT_DB_PW}
healthcheck:
# Check if the database is ready
test: ["CMD-SHELL", "pg_isready -U bomnipotent_user -d bomnipotent_db"]
# Interval between health checks
interval: 60s
# Timeout for each health check
timeout: 10s
# Number of retries before considering the container unhealthy
retries: 5
# Start period before the first health check
start_period: 10s
# Use the specified PostgreSQL image
# You may ddjust the container tag at will
image: postgres:17-alpine3.21
logging:
# Use the local logging driver
driver: local
options:
# Limit the log size to 10MB
max-size: "10m"
# Keep a maximum of 3 log files
max-file: "3"
networks:
# Connect to the specified network
- bomnipotent_network
# Restart the container if it has stopped for some reason other than a user command
restart: always
volumes:
# Mount the volume for persistent data storage
- bomnipotent_data:/var/lib/postgresql/data
bomnipotent_server:
# Name of the server container
container_name: bomnipotent_server
depends_on:
# Ensure the database service is healthy before starting the server
bomnipotent_db:
condition: service_healthy
deploy:
resources:
limits:
# Limit the CPU usage to 0.5 cores
cpus: "0.5"
# Limit the memory usage to 512MB
memory: "512M"
environment:
# Pass the database password on to the server.
BOMNIPOTENT_DB_PW: ${BOMNIPOTENT_DB_PW}
healthcheck:
# Check if the server is healthy
# Your TLS certificate is most likely not valid for "localhost"
# Hence the --insecure flag
test: ["CMD-SHELL", "curl --fail --insecure https://localhost:8443/health || exit 1"]
# Interval between health checks
interval: 60s
# Timeout for each health check
timeout: 10s
# Number of retries before considering the container unhealthy
retries: 5
# Start period before the first health check
start_period: 10s
# This is the official docker image running a BOMnipotent Server instance.
image: wwhsoft/bomnipotent_server:latest
logging:
# Use the local logging driver
driver: local
options:
# Limit the log size to 10MB
max-size: "10m"
# Keep a maximum of 3 log files
max-file: "3"
networks:
# Connect to the specified network
- bomnipotent_network
ports:
# Map port 443 on the host to port 8443 on the container
# This allows to connect to it via encrypted communication from the internet
- target: 8443
published: 443
# Restart the container if it has stopped for some reason other than a user command
restart: always
volumes:
# Bind mount the config folder on the host
- type: bind
source: ./bomnipotent_config
target: /etc/bomnipotent_server/configs/
read_only: true
# Bind mount the SSL directory
- type: bind
source: /etc/ssl
target: /etc/ssl
read_only: true
# The subscription can be stored inside the container
- bomnipotent_subscription:/root/.config/bomnipotentname: bomnipotent_server_containers
networks:
bomnipotent_network:
driver: bridge
name: bomnipotent_network
volumes:
bomnipotent_data:
driver: local
bomnipotent_subscription:
driver: local
services:
bomnipotent_db:
container_name: bomnipotent_db
deploy:
resources:
limits:
cpus: "0.5"
memory: "512M"
environment:
POSTGRES_DB: bomnipotent_db
POSTGRES_USER: bomnipotent_user
POSTGRES_PASSWORD: ${BOMNIPOTENT_DB_PW}
healthcheck:
test: ["CMD-SHELL", "pg_isready -U bomnipotent_user -d bomnipotent_db"]
interval: 60s
timeout: 10s
retries: 5
start_period: 10s
image: postgres:17-alpine3.21
logging:
driver: local
options:
max-size: "10m"
max-file: "3"
networks:
- bomnipotent_network
restart: always
volumes:
- bomnipotent_data:/var/lib/postgresql/data
bomnipotent_server:
container_name: bomnipotent_server
depends_on:
bomnipotent_db:
condition: service_healthy
deploy:
resources:
limits:
cpus: "0.5"
memory: "512M"
environment:
BOMNIPOTENT_DB_PW: ${BOMNIPOTENT_DB_PW}
healthcheck:
test: ["CMD-SHELL", "curl --fail --insecure https://localhost:8443/health || exit 1"]
interval: 60s
timeout: 10s
retries: 5
start_period: 10s
image: wwhsoft/bomnipotent_server:latest
logging:
driver: local
options:
max-size: "10m"
max-file: "3"
networks:
- bomnipotent_network
ports:
- target: 8443
published: 443
restart: always
volumes:
- type: bind
source: ./bomnipotent_config
target: /etc/bomnipotent_server/configs/
read_only: true
- type: bind
source: /etc/ssl
target: /etc/ssl
read_only: true
- bomnipotent_subscription:/root/.config/bomnipotentStore this as “compose.yaml”. Then, call:
docker compose --detachdocker compose -dYour server is now up and running!
It is not? Please contact me !
Run “docker ps” to check if it is healthy.
Creating an Admin
Several interactions with BOMnipotent require a user with admin rights. One of these is granting a new user admin rights. This means that some kind of bootstrapping mechanism is required.
Step 1: Create User
First, you will need to create a user account :
bomnipotent_client --domain=<server> user request <your-email>bomnipotent_client -d <server> user request <your-email>
[INFO] Generating new key pair
[INFO] Storing secret key to "/home/simon/.config/bomnipotent/secret_key.pem" and public key to "/home/simon/.config/bomnipotent/public_key.pem"
[INFO] User request submitted. It now needs to be confirmed by a user manager.To make things a litle less verbose, let’s store the domain of your server and your email address in a user session :
bomnipotent_client --domain=<server> --email=<your-email> session loginbomnipotent_client -d <server> -e <your-email> session login
[INFO] Storing session data in /home/simon/.config/bomnipotent/session.tomlStep 2: Mark User as TMP Admin
Due to security reasons, the user needs to already exist in the database at this point. Otherwise, a malicious actor could anticipate the email address you use for your admin, and make their own request at an opportune time. To prevent this, the tmp admin mechanism blocks all requests to newly add this particular user to the database.
Next, you will become the user manager that was mentioned in the server reply: Log onto your server machine, and in your server configuration file prepend
tmp_admin = "<your-email>"It is important to add this line at the beginning of the file, otherwise BOMnipotent might try to interpret this field as part of another section.
Your server logs should now show that the configuration has been reloaded, in addition to the user request you made earlier.
docker logs bomnipotent_server
...
2025-03-06 11:30:15 +00:00 [INFO] Received POST request from 101.102.103.104 to https://bomnipotent.wwh-soft.com/user/info@wwh-soft.com
2025-03-06 11:32:56 +00:00 [INFO] Configuration successfully reloaded from "/etc/bomnipotent_server/configs/config.toml"
...Step 3: Make User a full Admin
The server now treats authenticated requests from that user as if that user was an admin. To become a permanent admin, you first need to approve your user request. Back on the client, call
bomnipotent_client user approve <your-email>
[INFO] Changed status of info@wwh-soft.com to APPROVEDNow you can make yourself a full server admin:
bomnipotent_client user-role add <your-email> admin
[INFO] Added role to userStep 4: Remove TMP Admin Mark
The stat of being a temporary admin is intended to be, well, temporary. The server logs a warning whenever you use temporary access rights:
docker logs bomnipotent_server -n 4
2025-03-06 14:51:35 +00:00 [INFO] Received POST request from info@wwh-soft.com to https://bomnipotent.wwh-soft.com/user/info@wwh-soft.com/roles
2025-03-06 14:51:35 +00:00 [WARN] Temporary admin functionality is enabled for info@wwh-soft.com
2025-03-06 14:51:35 +00:00 [INFO] User info@wwh-soft.com was authenticated as a temporary admin
2025-03-06 14:51:35 +00:00 [INFO] Temporary admin info@wwh-soft.com has permission USER_MANAGEMENT to perform this actionBut now that you have successfully made yourself a permanent admin, you can and should remove the “tmp_admin” field from the configuration file again.
You are now ready to activate your subscription .
Activating your Subscription
Most actions that add data to your BOMnipotent database require an active subscription, while reading and removing data do not. This policy ensures that your users do not loose access to the existing data should you one day choose to stop paying for the product.
Commercial entities like companies can acquire a subscription on bomnipotent.de . If you are a non-commercial entity, you can use BOMnipotent without any charge. Request access by sending an email to info@wwh-soft.com .
Shortly after you have acquired a subscription, you will receive an email containing your subscription key.
Subscriptions can only be managed by a user with the “admin” role. Create one if you haven’t already.
Logged in as that user, call
bomnipotent_client subscription activate <your-subscription-key>
[INFO] Successfully stored subscription key.To check the current status of your subscription, run
bomnipotent_client subscription status
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Key │ Product │ Subscription Status │ Valid Until │ Last Updated │ Assessment │
├──────────┼─────────────┼─────────────────────┼─────────────────────────┼─────────────────────────┼───────────────────────────┤
│ ***ccfb3 │ BOMnipotent │ active │ 2025-04-10 17:26:29 UTC │ 2025-03-10 16:26:29 UTC │ The subscription is valid │
│ │ │ │ │ │ . │
╰──────────┴─────────────┴─────────────────────┴─────────────────────────┴─────────────────────────┴───────────────────────────╯Configuration
This section describes how you can make an instance of BOMnipotent server your own. It introduces the config file , and explains all required and optional parameters it understands.
Subsections of Configuration
The Config File
Your instance of BOMnipotent Server is configured using a config file. It contains several values, provided in TOML Format . The setup instructions each contain a config file that you can fill with your specific data. All configurations accepted by BOMnipotent Server are described in the rest of this section .
(Re)Loading Configurations
Many configurations support hot reloading. This means that you can change them inside the file, and they take effect without requiring a restart of the server. BOMnipotent Server achieves this by watching for changes of files in the directory that the config file resides in. You can verify a successful reload of the configurations by looking at the logs:
docker logs bomnipotent_server -n 1
2025-03-06 15:34:45 +00:00 [INFO] Configuration successfully reloaded from "/etc/bomnipotent_server/configs/config.toml"If something does not work as intended, BOMnipotent will also let you know in the logs:
docker logs bomnipotent_server -n 6
2025-03-06 16:11:03 +00:00 [ERROR] Failed to read config file "/etc/bomnipotent_server/configs/config.toml": Failed to parse config file: TOML parse error at line 5, column 1
|
5 | starlight_throughput = "16 GW"
| ^^^^^^^^^^^^^^^^^^^^
unknown field `starlight_throughput`, expected one of `allow_http`, `allow_tlp2`, `certificate_chain_path`, `db_url`, `default_tlp`, `domain`, `dos_prevention_limit`, `dos_prevention_period`, `log_level`, `provider_metadata_path`, `publisher_data`, `secret_key_path`, `tmp_admin`, `user_expiration_period`If the configuration loading produces an error during server startup, the process is aborted. If the configuration cannot be reloaded for an already running server, then the last valid configuration is left untouched.
The official BOMnipotent Server docker image looks for the config file at the path “/etc/bomnipotent_server/configs/config.toml” inside the container. It is recommended to read-only bind the container path “/etc/bomnipotent_server/configs/” to a directory of your choice on the host machine.
Important: For the hot reloading to work, your docker volume must bind to the directory in which the config file is located, not to the file itself. With a direct file binding BOMnipotent will not receive file events and thus cannot reload the config on change.
Environment Variables
Inside your config files, you can reference environment variables. To do so, simply use ${<some-env-var>} anywhere within the file, where “<some-env-var>” is replaced with the name of the variable.
For example, if you provide
BOMNIPOTENT_DB_PW=eHD5B6S8Kze3export BOMNIPOTENT_DB_PW=eHD5B6S8Kze3set BOMNIPOTENT_DB_PW=eHD5B6S8Kze3$env:BOMNIPOTENT_DB_PW = "eHD5B6S8Kze3"docker run -e BOMNIPOTENT_DB_PW=eHD5B6S8Kze3 wwhsoft/bomnipotent_server --detachdb_url = "postgres://bomnipotent_user:${BOMNIPOTENT_DB_PW}@bomnipotent_db:5432/bomnipotent_db"You wouldn’t actually use this publicly available example passwort, would you?
BOMnipotent Server supports reading variables from a .env file. If a file with that exact name, “.env”, is located next to your config file, the server will try to evaluate it before loading the config.
Changing the .env file while BOMnipotent Server is running will trigger a hot reloading and a re-evaluation of both the .env and the config file.
Required Configs
This section explains all parameters which you need to set in order for BOMnipotent Server to start. This required data is specific to you and your setup, which is why it is impossible to assume a meaningful default here.
Subsections of Required Configs
Database URL
The “db_url” configuration does not support hot reloading. You will need to restart the server after modifying it.
BOMnipotent Server is your gateway for providing supply chain security data and managing access to it. The data itself is stored in a SQL database.
At the moment, only PostgreSQL is supported as a driver.
This database can in principle run in the same environment, in a different container, or on a remote server. BOMnipotent needs to be taught how to reach it. The parameter for providing this information in the config file is “db_url”, and the syntax is the following:
db_url = "<driver>://<user>:<password>@<domain>:<port>/<database>"BOMnipotent will be cross with you if the string you provide does not adhere to this format.
An actual entry could for example be
db_url = "postgres://bomnipotent_user:${BOMNIPOTENT_DB_PW}@bomnipotent_db:5432/bomnipotent_db"Let’s break this down:
- The driver is “postgres”, which is the only driver currently supported.
- The username is “bomnipotent_user”, because this is the value that was provided to PostgreSQL during the setup.
- The password is read from the external variable “BOMNIPOTENT_DB_PW”, which may be provided via environment or .env file. You could also store it in the config file directly, but this is considered bad practice.
- The domain is “bomnipotent_db”, which is the name of the docker container running the database. For a database in the same environment this would instead be “localhost”, and for an external database it would be some other domain or IP address.
- The port is 5432, which is the default port that the PostgreSQL listens to. In this case the docker container is in the same docker network as the BOMnipotent Server container. Without this direct connection, you would need to map this internal port to an arbitrary external port in the docker setup, and provide this external port in the config.
- The database itself is also called “bomnipotent_db”, because this is the value that was provided to PostgreSQL during the setup.
If BOMnipotent Server cannot reach the database, it will let you know in the logs.
Server Domain
BOMnipotent Server is not only reachable per API, but also displays some static XML and HTML pages. One important example is that it may generate CSAF Provider Metadata for you. As some of these pages reference one another, the server needs to know the full domain behind which it is reachable from the internet.
The parameter is simply called “domain”. Providing a protocol is optional, “https” is assumed as a default.
The relevant part in the config file may for example look like this:
domain = "https://bomnipotent.wwh-soft.com"domain = "bomnipotent.wwh-soft.com"TLS Config
The TLS configuration does not support hot reloading. You will need to restart the server after modifying it.
What is TLS?
This section serves to give people who never had to deal with TLS a broad understanding of the process. Feel free to skip ahead to the section about configuration .
Transport Layer Security (TLS), sometimes also called by its legacy name Secure Socket Layer (SSL), is what puts the “S” in “HTTPS”. It is a very sophisticated, smart and widely used method for end-to-end encrypting of communication over the internet, but it can also lead to a lot of head scratching.
In very broad terms, TLS works as outlined in the following paragraphs:
Your server generates a pair of secret and public key. Anyone can use the public key to either encrypt a message that only the secret key can decrypt, or to decrypt a message that was encrypted with the secret key.
When a client reaches out to your sever asking for encryption, the latter responds by sending a TLS certificate. It contains several important field:
- Your severs public key, which the client can now use to send messages only the server can read.
- The domain(s) this certificate is valid for. These are usually stored in the field “Subject Alternative Names” (SAN), and are meant to ensure that the client is really talking to the address it wanted to reach.
- A digital signature, cryptographically proving that the certificate was not altered along the way.
- Many more. Just have a look at any certificate in your browser.
The digital signature is not created with the server’s secret key, because the client does not trust that key yet. Instead, there are some (several hundred) public keys stored on your machine that belong to so called “Root Certificate Authorities”. The job of these is to sign server certificates after they have verified that the bearer of the secret key is also the owner of the domains they claim.
For practical reasons the root CAs usually do not directly sign a server certificate, but rather an intermediate certificate, which is then used to sign the final certificate.
All in all, the chain of trust thus looks like this:
- The Client trusts the root CA.
- The root CA trusts the intermediate CA.
- The intermediate CA trusts the server.
Thus, the client decides to trust the server and establich an encrypted connection.
TLS Configuration
Because BOMnipotent is secure-by-default, it requires you to make at least one statement about TLS encryption. The “tls” section of your configuration file accepts the following fields:
[tls]
allow_http = false # Optional, is false by default
certificate_chain_path = "your-chain.crt"
secret_key_path = "your-key.pem"Providing the TLS certificate paths is required if HTTP is not allowed (because the server could not offer any connection otherwise), and it is optional if HTTP is explicityl allowed by setting allow_http to true. If you set either the certificate_chain_path or the secret_key_path , you will also need to set the other. Furthermore, the server checks if there is a mismatch between the two.
allow_http
If you set this optional field to true, your BOMnipotent Server will allow unencrypted connections vie port 8080. This makes sense if your server is running behind a reverse proxy, and is communicating to it only over the local network. In this setup, the server is not directly reachable from the internet, so the reverse proxy can handle encryption for it.
Please note that the OASIS CSAF Standard requires that the access to your CSAF documents is encrypted!
secret_key_path
The value of “secret_key_path” needs to point to a file that is reachable for BOMnipotent server. One common value is:
secret_key_path = "/etc/ssl/private/<yourdomain>_private_key.key"If your BOMnipotent Server is running inside a docker container, you may want to bind mount the container directory “/etc/ssl” to the directory with the same name on the host.
The file needs to be an ASCII-armoured secret key in PEM-Format . Luckily, this is the format you typically receive when obtaining a TLS certificate.
The contents of the file could for example look like this:
-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIHru40FLuqgasPSWDuZhc5b2EhCGGcVC+j3DuAqiw0/m
-----END PRIVATE KEY-----This is the secret key from a certificate generated for the BOMnipotent integration tests.
certificate_chain_path
Likewise, the “certificate_chain_path” needs to point to a file reachable by BOMnipotent Server. A typical location is:
certificate_chain_path = "/etc/ssl/certs/<yourdomain>-fullchain.crt"The chain needs to contain all certificates in the chain of trust concatenated together, beginning with the one for your sever and ending with the root certificate authority.
The contents of the full certificate chain for the integration test looks like this:
-----BEGIN CERTIFICATE-----
MIIB8jCCAaSgAwIBAgIBAjAFBgMrZXAwPTELMAkGA1UEBhMCREUxHDAaBgNVBAoT
E0JPTW5pcG90ZW50IFRlc3QgQ0ExEDAOBgNVBAMTB1Rlc3QgQ0EwHhcNMjUwMzA1
MTMxNzEwWhcNMjUwNDI0MTMxNzEwWjBFMQswCQYDVQQGEwJERTEgMB4GA1UEChMX
Qk9Nbmlwb3RlbnQgVGVzdCBTZXJ2ZXIxFDASBgNVBAMTC1Rlc3QgU2VydmVyMCow
BQYDK2VwAyEAMzw8ZVgiuP3bSwh+xcBXu62ORwakr/D+s0XQks1BTFOjgcAwgb0w
DAYDVR0TAQH/BAIwADBIBgNVHREEQTA/gglsb2NhbGhvc3SCCTEyNy4wLjAuMYIT
c3Vic2NyaXB0aW9uX3NlcnZlcoISYm9tbmlwb3RlbnRfc2VydmVyMBMGA1UdJQQM
MAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIGwDAdBgNVHQ4EFgQUC/RAGubXMfx1
omYTXChtqneWDLcwHwYDVR0jBBgwFoAUStstIFLzDjBSHYSsSr9hSgRVZT4wBQYD
K2VwA0EAXN/6PpJQ0guaJq67kdKvPhgjWVdfxxeCAap8i24R39s7XxNz5x5lPyxA
DQG63NS/OED43+GfpkUguoKxfZLBBA==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIBazCCAR2gAwIBAgIBATAFBgMrZXAwPTELMAkGA1UEBhMCREUxHDAaBgNVBAoT
E0JPTW5pcG90ZW50IFRlc3QgQ0ExEDAOBgNVBAMTB1Rlc3QgQ0EwHhcNMjUwMzA1
MTMxNzEwWhcNMjUwNjEzMTMxNzEwWjA9MQswCQYDVQQGEwJERTEcMBoGA1UEChMT
Qk9Nbmlwb3RlbnQgVGVzdCBDQTEQMA4GA1UEAxMHVGVzdCBDQTAqMAUGAytlcAMh
AIoFFlU/ADa77huqAb5aBY9stDwzzDd/Tdocb9RZDBG2o0IwQDAPBgNVHRMBAf8E
BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUStstIFLzDjBSHYSsSr9h
SgRVZT4wBQYDK2VwA0EARYL+v9oDGjaSW5MhjjpQUFXnAVMFayaKFfsfbbkmTkv4
+4SRWFb4F/UULlbbvlskSgt8jAaaTSk7tu/iX67YDw==
-----END CERTIFICATE-----The first certificate (“MIIB8j…”) authenticates the server, the second one (“MIIBaz…”) is that of the root CA.
There is no intermediate certificate authority here because it is not required for the tests. In your productive environemnt with real certificates you will most likely need to add an intermediate certificate in the middle.
CSAF Provider Metadata
The OASIS Standard requires that providers of CSAF documents offer a “provider-metadata.json”, which needs to follow a specific schema .
BOMnipotent strives to make it as easy as possible to fulfil this requirement. You can either generate the file from a few inputs, or provide a file for BOMnipotent to load.
Generating Data
By providing some user-specific inputs, you can make BOMnipotent generate a valid provider-metadata.json file. This is much easier than creating the file by hand, but offers somewhat less control.
The relevant section in your config file looks like this:
[provider_metadata.publisher]
name = "<name of your organsiation>"
namespace = "https://<your-domain>.<top-level>"
category = "vendor"
issuing_authority = "<Additional info>" # Optional
contact_details = "<Please contact us at...>" # OptionalPublisher Data Inputs
Name
This field requires you to provide the name of your company, organisation, or you as an individual.
Namespace
While the “name” field is primarily aimed at humans, the “namespace” is used by machines to identify your organisation across various security documents. It needs to be in URI format, including protocol, domain and top-level domain. Because it refers to your whole organisation, it should not contain a subdomain.
This is what sets the “provider_metadata.publisher.namespace” field apart from the “domain” configuration: The latter points to your instance of BOMnipotent Server, while the former is much more general.
Category
The publisher category is a machine readable classification of who you are. According to the CSAF Standard , the publisher categories allows the values “coordinator”, “discoverer”, “other”, “translator”, “user” or “vendor”. As a user of BOMnipotent Server, you are most likely a “vendor”, meaning a developer or retailer of products or a service.
Issuing Authority
This optional field can be used to clarify your connection to the hosted documents. Are you the developer and maintainer? Are you a retailer? The input is in free form.
Contact Details
This optional field allows you to offer contact details for general or security inquiries. The input is a string in free form.
Generated Document
Once you have provided the data and started the server, the generated document will host it under “your-domain/.well-known/csaf/provider-metadata.json”. You can see a live example here and a static example here:
{
"canonical_url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/provider-metadata.json",
"distributions": [
{
"rolie": {
"feeds": [
{
"summary": "WHITE advisories",
"tlp_label": "WHITE",
"url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/white/csaf-feed-tlp-white.json"
},
{
"summary": "GREEN advisories",
"tlp_label": "GREEN",
"url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/green/csaf-feed-tlp-green.json"
},
{
"summary": "AMBER advisories",
"tlp_label": "AMBER",
"url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/amber/csaf-feed-tlp-amber.json"
},
{
"summary": "RED advisories",
"tlp_label": "RED",
"url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/red/csaf-feed-tlp-red.json"
},
{
"summary": "UNLABELED advisories",
"tlp_label": "UNLABELED",
"url": "https://bomnipotent.wwh-soft.com/.well-known/csaf/unlabeled/csaf-feed-tlp-unlabeled.json"
}
]
}
}
],
"last_updated": "2025-03-06T16:13:24.632235974Z",
"list_on_CSAF_aggregators": true,
"metadata_version": "2.0",
"mirror_on_CSAF_aggregators": true,
"publisher": {
"category": "vendor",
"contact_details": "For security inquiries, please contact info@wwh-soft.com",
"name": "Weichwerke Heidrich Software",
"namespace": "https://wwh-soft.com"
},
"role": "csaf_provider"
}This file contains a ROLIE feed for all your CSAF documents, which is probably the main reason why you do not want to create this document by hand.
The “last_updated” field is generated from the last modification timestamp of your config file.
BOMnipotent assumes that you want your CSAF documents listed and mirrored on publicly available repositories. This only concerns the documents labeled TLP:WHITE / TLP:CLEAR! The aggregators do not have access to any documents classified otherwisely.
BOMnipotent helps you fulfil all requirements to be a CSAF Provider , according to the OASIS standard.
Providing Filepath
If for some reason you want to have full control of the provider-metadata document, you can provide a filepath in the config file:
[provider_metadata]
path = "<filepath>"BOMnipotent will then read the file, check that it follows the provider-metadata json schema , and host it.
You have to provide either a path to a file, or publisher data. If you provide neither or both, the config will not be loaded.
Optional Configs
This section lists all optional configuration parameters for BOMnipotent. They can be used to further customise the server’s behaviour. If they are not provided, they assume a meaningful default value.
BOMnipotent follows secure-by-default design principles, meaning you can in good conscience ignore these parameters for the inital sever setup.
Subsections of Optional Configs
Logging
To keep track of the history of interactions with BOMnipotent Server, every event potentially results in a log being written. These logs are printed to the standard output. If the server is running inside a docker container named “bomnipotent_server”, you can see the last 3 lines of logs by calling
docker logs bomnipotent_server -n 3
2025-03-08 09:16:10 +00:00 [INFO] Database is ready.
2025-03-08 09:16:15 +00:00 [DEBUG] Header X-Auth-Email was not found in request
2025-03-08 09:16:15 +00:00 [DEBUG] Received healthcheck request from 127.0.0.1The logs have the format “Date, Time, Timezone, Log Level, Message”.
The relevant section of your config file to manipulate logging looks like this:
[log] # This section is optional
level = "info" # This is the default severity levelThe logs do not contain confidential information. For example, the notification about the database connection obfuscates username and password:
2025-03-08 09:16:10 +00:00 [INFO] Creating connection pool for database: postgres://[user]:[password]@database:5432/bomnipotent_dbSeverity Level
BOMnipotent Server supports five log levels:
Each severity level includes the log messages from the previous ones. The default severity level is “info”, meaning it prints log messages with severities “error”, “warn” and “info”.
Error
An error indicates that an operation has to be aborted. Either the user input or the configuration has to change for it to work, and it needs to be triggered again.
Common examples include:
- A requested resource is not found.
- The user does not have sufficient permissions.
- The configuration file cannot be loaded.
Warn
A warning is displayed when some input or configuration is suboptimal. The operation is still completed, but you or the user are urged to change either input or configuration.
Common examples include:
- A temporary admin is configured.
- A document without TLP classification is requested, but no default-tlp has been configured.
- You have not updated BOMnipotent for over a year.
Info
This is the default severity level for logs.
Logs with level info indicate regular events that are important, but rare enough to not overwhelm the output.
Common examples include:
- A request was made to an endpoint (although some endpoints like /health log with a lower severity than info).
- A user was authenticated.
- The config file has successfully been reloaded.
Debug
Configure debug log severity level to find errors in the configuration or user input. These logs help to understand, step by step, what the program does, and where something may go wrong.
Common exmples include:
- Responses sent to the client.
- Interactions with the database.
- The contents of a succesfully reloaded config file.
Trace
As the lowest possible severity level, trace logs contain a lot of output. In contrast to the debug level, the trace level is meant to assist in finding errors in BOMnipotent itself. It is thus unlikely that you will ever need to configure this level, because it is mainly targeted at the developer. Common examples include:
- The body of a request (truncated after 1000 characters).
- The filters applied to a database request.
- The server received a file event because someone interacted with the config file (or any adjacent file).
Temporary Admin
Only an admin can give admin permissions to a user. In order to create the first admin, you therefore need to enable these permissions via another, temporary path. This is done with the config parameter “tmp_admin”, which takes the email of a user as an input:
tmp_admin = "<email>"The whole procedure is described in the setup instructions .
For security reasons, the rules surrounding temporary adminship are rather strict, and allow only one specific order of operations:
- Request a new user. The “tmp_admin” parameter may not be set at this point, or the request is denied by the server. A request for a new user with the same email is also denied.
- Mark that user as a temporary admin in the configuration. If the user does not exists, the configuration will fail to load.
- Make the user a proper admin by approving them and adding the admin role.
- Remove the “tmp_admin” parameter from the server configuration. The server logs will print warning messages while it is still active.
If the rules were less strict and you could designate a temporary admin before the user is registered in the database, an attacker could potentially request a new user with the correct email address and would then have admin permissions on your system.
TLP Config
CSAF documents can and in fact should be classified using the Traffic Light Protocol (TLP) . It clarifies if and with whom you can share documents that you have access to. The somewhat older TLP v1.0 standard knows four different classifications:
- TLP:RED: This document may not be disclosed to anyone else.
- TLP:AMBER: This document can be spread on a need-to-know basis within their organization and its clients.
- TLP:GREEN: This document can spread this within the recipient’s community.
- TLP:WHITE: There is no limit on disclosure.
The more current TLP v2.0 standard replaces TLP:WHITE with TLP:CLEAR, and adds the new classification TLP:AMBER+STRICT, which only allows sharing on a need-to-know basis with the recipient’s organisation, but not beyond.
Documents hosted by BOMnipotent Server that are classified as TLP:WHITE or TLP:CLEAR are visible to everyone, be they admin, completely unauthenticated user or crawler bot!
The “tlp” section of your configuration file may contain the following fields:
[tlp]
allow_tlp2 = true # Default is false
default_tlp = "amber+strict" # Default is "red"Allowing TLP v2.0
The current OASIS CSAF Standard requires documents to be classified with TLP v1.0 labels. However, many companies would prefer to use the TLP:AMBER+STRICT classification from the TLP v2.0 standard for their documents. Furthermore, the TLP v2.0 standard will become mandatory once the CSAF standard 2.1 is released.
To be fully compliant with the CSAF standard, BOMnipotent does not allow TLP v2.0 labels by default. You can, however, set the field “allow_tlp2” to true in the “tlp” section of your config file:
[tlp]
allow_tlp2 = trueIf you do, both TLP v1.0 and TLP v2.0 labels will be accepted.
If you do not, and BOMnipotent encounters TLP v2.0 labels, it will silently convert TLP:CLEAR to TLP:WHITE. Because TLP:AMBER+STRICT has no direct equivalent in TLP v1.0, BOMnipotent will take the conservative approach, convert it to TLP:RED, and log a warning.
Default TLP
Classifying a CSAF document with a TLP label is optional, and a TLP classification is not even part of the CycloneDX standard for BOM documents. BOMnipotent needs to at least know if the document is labelled TLP:CLEAR / TLP:WHITE and thus publicly available, or if access to it is restricted.
It is good practice to define a TLP classification that BOMnipotent can fall back to for an unlabelled document. You can do that in your config file via:
[tlp]
default_tlp = "amber"The deserialisation gives you some leeway: It does not consider the casing, and the “TLP:” prefix is optional. The values “amber”, “AMBER”, “tlp:amber” and “TLP:AMBER” are all recognised as TLP:AMBER.
If you do not provide a default TLP label, and BOMnipotent encounters an unlabelled document, it will default to TLP:RED and log a warning.
The default TLP label is evaluated at the time of access, not at the time of writing. Unlabelled documents remain unlabelled in the database. If at any point you change the default TLP label, you thus change it for all unlabelled documents of past and future .
User Expiration
When a request for a new user account is made, it deposits a public key in the database.
This key has an expiration data, after which it is not accepted anymore. This can be seen by calling:
./bomnipotent_client user list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ User Email │ Status │ Expires │ Last Updated │
├───────────────────┼──────────┼───────────────────────────┼───────────────────────────┤
│ info@wwh-soft.com │ APPROVED │ 2026-03-03 11:30:15.62432 │ 2025-03-02 11:47:38.51048 │
│ │ │ 5 UTC │ 5 UTC │
╰───────────────────┴──────────┴───────────────────────────┴───────────────────────────╯By default, the key is valid for a little over a year after it was requested. This time can be configured with the “user_expiration_period” parameter. As values it accepts a time period in the human readable format “
user_expiration_period = "366 days"
user_expiration_period = "5 years"
user_expiration_period = "1 month"
user_expiration_period = "3 weeks"
user_expiration_period = "5 days"
If you really hate your users you could also use “hours”, “minutes”, seconds", “ms”, “us” or “ns” as units. BOMnipotent does not question how realistic your expectations are.
Changing this configuration does not affect the expiration dates of existing users! It will only influence how much time is given to newly requested users.
DOS Prevention
Denial of Service (DOS) attacks target programs or servers with the goal of making them unresponsive. They are notoriously hard to mitigate, because they are often based on flooding the service with otherwise legitimate requests.
BOMnipotent has several DOS prevention mechanisms in place (from disallowing any code that might crash the server to limiting the length of log outputs), but one particular technique can be tweaked by the user.
If the number of requests from a single source exceeds a limit within a time period, that source is put on a greylist for one hour, which automatically denies requests.
By default, this happens if the number of requests exceeds 100 within one minute, but you can modify this behaviour in your config file:
[dos_prevention]
limit = 50 # Default is 100
period = "30 seconds" # Default is "1 minute"This new config would make the server react faster to a possible DOS attack, but has a higher risk to falsely classify request as an attack.
Client
BOMnipotent Client is a tool to interact with BOMnipotent Server. It can be used by consumers to download documents, or to request access. Server admins and managers on the other hand can use it to remotely modify the server database.
Subsections of Client
Basic Usage
This section covers the basics of using the BOMnipotent Client. It is relevant for both consumers and producers of supply chain security documents.
Subsections of Basic Usage
Installing the Client
To manually download BOMnipotent Client, go to https://www.bomnipotent.de/downloads/ , select your platform and version, and click on the download button.
To automate this process further, you can access the download link directly:
Invoke-WebRequest -Uri https://www.bomnipotent.de/downloads/raw/latest/windows/bomnipotent_client.exe -OutFile bomnipotent_client.execurl -O https://www.bomnipotent.de/downloads/raw/latest/macos/bomnipotent_client
chmod +x bomnipotent_clientwget https://www.bomnipotent.de/downloads/raw/latest/debian-glibc/bomnipotent_client;
chmod +x bomnipotent_clientwget https://www.bomnipotent.de/downloads/raw/latest/linux-musl/bomnipotent_client;
chmod +x bomnipotent_clientReplace “latest” with a specific version tag, e.g. “v1.0.0”, to download that version instead of the latest.
To access BOMnipotent Client from anywhere in your system, move it into a folder that is included in your PATH environment variable. This step is optional, though.
Account Creation
Most interactions with BOMnipotent require some permission. The sole exception is accessing data classified as TLP:WHITE / TLP:CLEAR.
Permissions are linked to user accounts. For more information on how permissions are granted, see the section about Access Management .
Creating a new Account
To create a new user account, run
bomnipotent_client --domain=<server> user request <your-email>bomnipotent_client -d <server> user request <your-email>If you call this for the first time, it will create a new key pair using the ED25519 Algorithm . A key pair consists of a public and a secret key. Both are stored in your local userfolder.
[INFO] Generating new key pair
[INFO] Storing secret key to "/home/simon/.config/bomnipotent/secret_key.pem" and public key to "/home/simon/.config/bomnipotent/public_key.pem"
[INFO] User request submitted. It now needs to be confirmed by a user manager.The secret key is more commonly called “private key”, but the author believes that “secret” is a more apt description and reduces the chance to confuse it with the public key.
The public key can, in principle, be shared with anyone. The “user request” call sends it to the BOMnipotent server. The secret key however should be treated like a password!
Subsequent calls to BOMnipotent Client will reuse an existing key pair.
Now that your request is made, you need to wait for a user manager of the server to approve it. After that you can start making authenticated requests .
If you are said user manager and are looking for how approve users, consult the section about User Management .
Using stored Keys
If you have a key pair stored in the default user location (which depends on your platform), BOMnipotent Client will automatically read and use it.
If you would instead like to reuse an existing stored at a different location, you can add the path as a positional argument:
bomnipotent_client --domain=<server> user request <your-email> <path/to/key>bomnipotent_client -d <server> user request <your-email> <path/to/key>For this to work the key needs to have been generated using the ED25519 Algorithm , and it needs to be stored in PEM format. If you insist on managing keys yourself, or would like to see an example, then the easiest way to generate such a pair is to call
openssl genpkey -algorithm ED25519 -out secret_key.pemto generate a secret key, and thenopenssl pkey -in secret_key.pem -pubout -out public_key.pemto generate the corresponding public key.
If you accidently specify the path to your secret key, BOMnipotent Client will throw an error before sending it to the server.
Authenticating
Authentication requires that you have requested a user account , and that it has been approved by a user manager.
Once your account (meaning your email and public key) is approved, you can provide your email to Bomnipotent Client to make a request that can be authenticated by the server:
bomnipotent_client --domain=<server> --email=<your-email> <command>bomnipotent_client -d <server> -e <your-email> <command>BOMnipotent Client then automatically reads your secret key and uses it for authentication.
Your secret key is used to cryptographically sign the HTTP method, your email, a timestamp and the request body. This simultaneously protects your request against others impersonating you, malicious modifications and replay attacks. The secret key achieves all that without ever having to leave your local computer, the beauty of which is, sadly, beyond the scope of this documentation.
If you are not storing your keys in the default user location, you have to tell BOMnipotent Client the path to it via a command line option:
bomnipotent_client --domain=<server> --email=<your-email> --secret-key=<path/to/key> <command>bomnipotent_client -d <server> -e <your-email> -s <path/to/key> <command>To avoid providing three extra arguments to every single request, you can instead store this data in a User Session
User Session
Login
The BOMnipotent Client offers several global optional arguments. To avoid having to provide these time and time again, you can use the login command to store them in a user session:
bomnipotent_client --domain=<server> --email=<your-email> --output=<mode> --secret-key=<path/to/key> --trusted-root=<path/to/cert> loginbomnipotent_client -d <server> -e <your-email> -o <mode> -s <path/to/key> -t <path/to/cert> loginThis will create a file in the local user folder which stores the provided parameters.
[INFO] Storing session data in /home/simon/.config/bomnipotent/session.tomlWhenever you call the BOMnipotent Client from now on, it will use these parameters automatically:
bomnipotent_client bom list # Will automatically reach out to the provided domain and use your authentication data.Overwriting Parameters
If you are logged in and provide any of the global optional parameters to a BOMnipotent Client call, it will use these instead:
bomnipotent_client --domain=<other-server> bom list # Will contact the other serverbomnipotent_client -d <other-server> bom list # Will contact the other serverTo permanently change the data stored in the session, simply login again with the new parameters.
This can also be used to remove parameters, simply by not providing them:
bomnipotent_client --domain=<other-server> --email=<your-email> --output=<mode> login # Will set secret-key and trusted-root to none.bomnipotent_client -d <other-server> -e <your-email> -o <mode> login # Will set secret-key and trusted-root to none.Status
To print the current parameters of your session, call:
bomnipotent_client session statusThe output is in TOML format (which is also how it is stored on your filesystem):
domain = "https://localhost:62443"
email = "admin@wwh-soft.com"
secret_key_path = "/home/simon/git/bomnipotent/test_cryptofiles/admin"
trusted_root_path = "/home/simon/git/bomnipotent/test_cryptofiles/ca.crt"If you prefer JSON, merely append the “–json” option:
./bomnipotent_client session status --json./bomnipotent_client session status -j
{
"domain": "https://localhost:62443",
"email": "admin@wwh-soft.com",
"secret_key_path": "/home/simon/git/bomnipotent/test_cryptofiles/admin",
"trusted_root_path": "/home/simon/git/bomnipotent/test_cryptofiles/ca.crt"
}If you are not logged in, you get an informational trace and an empty TOML/JSON output:
[INFO] No session data is currently stored[INFO] No session data is currently stored
{}If you would like to use this command to programatically check if session data exists, you can for example use the “raw” output mode to avoid the info trace, and check if the return value is empty:
#!/bin/bash
output=$(./bomnipotent_client --output raw session status)
if [ -n "$output" ]; then
echo "Found session data:"
echo "$output"
else
echo "Session not logged in."
fi$output = ./bomnipotent_client --output raw session status
if ($output) {
Write-Output "Found session data:"
Write-Output $output
} else {
Write-Output "Session not logged in."
}Logout
To remove all parameters, call logout:
bomnipotent_client logoutThis will remove the session file.
Log Level
BOMnipotent Client offers several severity levels of logs:
- error
- warn
- info (default)
- debug
- trace
They can be selected via:
bomnipotent_client --log-level=<LEVEL> <COMMAND>bomnipotent_client -l <LEVEL> <COMMAND>This defines the minimum severity level for a message to be logged: Choosing log level debug makes BOMnipotent print all messages of severity error, warn, info and debug, but not trace.
By default, BOMnipotent Client logs messages to stdout, regardless of severity level. You can instruct it to log to a file instead.
Info, Warn and Error
The default log-level is info. It prints some information, but does not overwhelm the user.
bomnipotent_client health
[INFO] Service is healthybomnipotent_client bom list
[INFO]
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Version │ Timestamp │ TLP │ Components │
├─────────────┼─────────┼─────────────────────────┼─────────┼────────────┤
│ BOMnipotent │ 1.0.0 │ 2025-02-01 03:31:50 UTC │ Default │ 363 │
╰─────────────┴─────────┴─────────────────────────┴─────────┴────────────╯Or, in case of an error:
[ERROR] Received response:
404 Not Found
BOM Volcano_1.0.0 not found in databaseDebug
The debug output mode prints some additional information which may be of interest when looking for the cause of an error in the input or setup:
bomnipotent_client --log-level=debug healthbomnipotent_client -l debug health
[DEBUG] Looking for secret key
[DEBUG] The provided key is a path: /home/simon/git/bomnipotent/test_cryptofiles/admin
[DEBUG] Reading secret key from provided path "/home/simon/git/bomnipotent/test_cryptofiles/admin"
[DEBUG] Adding trusted root certificate
[DEBUG] Signing request
[DEBUG] Assembled GET request to https://localhost:62443/health
[DEBUG] starting new connection: https://localhost:62443/
[INFO] Service is healthyTrace
In output mode trace, BOMnipotent additionally prints the module where the log message originated. This is mainly interesting for finding the cause of an error in the program itself.
bomnipotent_client --log-level=trace healthbomnipotent_client -l trace health
[bomnipotent_client] [TRACE] Running command Health with args Arguments {
domain: Some(
"https://localhost:62443",
),
email: Some(
"admin@wwh-soft.com",
),
log_level: Some(
Trace,
),
log_file: None,
output_mode: None,
secret_key: Some(
"/home/simon/git/bomnipotent/test_cryptofiles/admin",
),
trusted_root: Some(
"/home/simon/git/bomnipotent/test_cryptofiles/ca.crt",
),
command: Health,
}
[bomnipotent_client::keys] [DEBUG] Looking for secret key
[bomnipotent_client::keys] [DEBUG] The provided key is a path: /home/simon/git/bomnipotent/test_cryptofiles/admin
[bomnipotent_client::keys] [DEBUG] Reading secret key from provided path "/home/simon/git/bomnipotent/test_cryptofiles/admin"
[bomnipotent_client::request] [DEBUG] Adding trusted root certificate
[reqwest::blocking::wait] [TRACE] (ThreadId(1)) park without timeout
[reqwest::blocking::client] [TRACE] (ThreadId(14)) start runtime::block_on
[bomnipotent_client::request] [DEBUG] Signing request
[bomnipotent_client::request] [DEBUG] Assembled GET request to https://localhost:62443/health
[reqwest::blocking::wait] [TRACE] wait at most 30s
[reqwest::blocking::wait] [TRACE] (ThreadId(1)) park timeout 29.999994032s
[reqwest::connect] [DEBUG] starting new connection: https://localhost:62443/
[reqwest::blocking::wait] [TRACE] wait at most 30s
[reqwest::blocking::client] [TRACE] closing runtime thread (ThreadId(14))
[reqwest::blocking::client] [TRACE] signaled close for runtime thread (ThreadId(14))
[reqwest::blocking::client] [TRACE] (ThreadId(14)) Receiver is shutdown
[reqwest::blocking::client] [TRACE] (ThreadId(14)) end runtime::block_on
[reqwest::blocking::client] [TRACE] (ThreadId(14)) finished
[reqwest::blocking::client] [TRACE] closed runtime thread (ThreadId(14))
[bomnipotent_client::output] [INFO] Service is healthyLog File
To store the log output of a call to BOMnipotent Client in a file instead of printing it to stdout, call
bomnipotent_client --log-file=<PATH> <COMMAND>bomnipotent_client -f <PATH> <COMMAND>The output is the same, except that the stdout output is coloured according to its severity level, while the file output is not.
If BOMnipotent Client is called repeatedly with the same log-file, it will overwrite the existing contents, if the existing file looks like a log-file.
A file looks like a log-file to BOMnipotent if it is either empty or contains at least one of the strings “[ERROR]”, “[WARN]”, “[INFO]”, “[DEBUG]” or “[TRACE]”.
If an existing file does not look like a log-file, BOMnipotent gets cautious and aborts:
Logfile "/tmp/loggy.log" already exists and does not look like a logfile. Aborting before overwriting any data you do not want overwritten.Because the commands “bom get” / “csaf get” as well as the “fetch” command are meant for machine-processing, they print their output to stdout even if a log-file is configured. This separation of outputs makes it possible to simultaneously process the data and store potential error messages.
Output Mode
Withouth any specifications of the output-mode, BOMnipotent Client prints its log messages either to stdout, or to a configured log-file . This is great if it used by humans, but not so useful for automation. This is why BOMnipotent Client offers the two additional output-modes “code” and “raw” . They modify which output is printed where.
Output Streams
In output-modes “code” or “raw”, only the HTTP code or the response body are printed to stdout. If you configure a log-file , any logs up to the specified log-level will be stored there.
If on the other hand you do not specify a log-file, BOMnipotent still wants you to know if something goes wrong. This is why, in this case, logs of severity “error” or “warn” are printed to stderr.
Modes
Code
The code output prints only the HTTP status code of the response to stdout.
bomnipotent_client --output-mode=code healthbomnipotent_client -o code health
200This can come in handy if you want to use BOMnipotent Client in a script:
#!/bin/bash
set -e # Return on error
# ...other code...
./bomnipotent_client \
--output-mode=code \
--domain=$domain \
--log-level=debug \
--log-file="/tmp/loggy.log" \
session login
code=$(./bomnipotent_client health)
if (( code != 200 )); then
echo "Server at $domain is not healthy!"
cat /tmp/loggy.log
exit 1;
fiNote that there is no newline or carriage return character at the end of the output.
Attention: In code mode, BOMnipotent Client always exits with a terminal exit code of 0 (signaling success) if it can obtain any HTTP code. This way, the program is easier to use inside scripts that return on errors.
Raw
For calls to BOMnipotent Client that access some structured data, the raw output prints the response body, which is typically data in JSON format.
bomnipotent_client --output-mode=raw bom listbomnipotent_client -o raw bom list
[{"name":"BOMnipotent","version":"1.0.0","timestamp":"2025-01-03T05:38:03Z","tlp":null,"components":350}]The output can then easily be parsed and processed by your program logic.
Note that there is no newline or carriage return character at the end of the output.
For Consumers
This section covers typical use cases for consumers of supply chain security documents. In this context, “consumer” refers to a person or automation that has reading access (limited or unrestricted) to BOMs, vulnerabilities or CSAF documents.
Subsections of For Consumers
BOMs
Bills of Materials stand at the forefront of both BOMnipotents functionality and name. A BOM is a list of all components that make up a product. In the context of cybersecurity, the most prominent variant is the Software Bill of Materials (SBOM), but BOMs allow for more general considerations as well.
List
Running
bomnipotent_client bom listwill list all BOMs accessible to you:
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Version │ Timestamp │ TLP │ Components │
├─────────────┼─────────┼─────────────────────────┼───────────┼────────────┤
│ BOMnipotent │ 1.0.0 │ 2025-02-01 03:31:50 UTC │ TLP:WHITE │ 363 │
│ BOMnipotent │ 1.0.1 │ 2025-02-01 03:31:50 UTC │ TLP:WHITE │ 363 │
│ vulny │ 0.1.0 │ 2025-02-02 06:51:40 UTC │ TLP:AMBER │ 63 │
╰─────────────┴─────────┴─────────────────────────┴───────────┴────────────╯BOMs with label TLP:WHITE / TLP:CLEAR are visible to everyone. In this example, your account has access to one BOM with label TLP:AMBER.
Download
To create a local copy of all boms the server exposes to you, run:
bomnipotent_client bom download ./boms
[INFO] Storing BOMs under ./bomsThis will store the BOMs in the provided folder ("./boms", in this example). It will create the folder structure if it does not already exist. The BOMs are stored in files following the naming scheme {product name}_{product version}.cdx.json.
To avoid inconsistent behaviour accross operating systems, the name and version of the product are converted into lowercase, and most special characters are replaced by an underscore ‘_’. This means that, in principle, different products could lead to the same filename. In that case, BOMnipotent will display a warning instead of silently overwriting a file.
tree ./boms/
./boms/
├── bomnipotent_1.0.0.cdx.json
├── bomnipotent_1.0.1.cdx.json
└── vulny_0.1.0.cdx.json
1 directory, 3 filesBefore requesting files for download, BOMnipotent Client makes an inventory of the BOMs already present in the folder, and downloads only the missing ones.
BOMnipotent does not automatically replace existing files, even if they have changed on the server. It instead prints a warning message:
[WARN] File ./boms/white/2023/wid-sec-w-2023-0001.json already exists.
Use the "--overwrite" flag to replace it.
Skipping download to prevent data loss.You can tell BOMnipotent that you really want this file overwritten by using the “–overwrite” flag:
bomnipotent_client bom download ./boms --overwritebomnipotent_client bom download ./boms -oGet
You can directly display the contents of a single BOM to the consolte output by calling
bomnipotent_client bom get <NAME> <VERSION>
{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:60d5a033-6d54-4ac4-a5fa-824d0b04c718",
"version": 1,
"metadata": {
"timestamp": "2025-02-23T07:23:33+01:00",
"tools": {
"components": [
...This is especially useful if you want to use the contents of this BOM in a script. For example, to check for vulnerabilities in the supply chain, you could call:
bomnipotent_client bom get <NAME> <VERSION> | grype
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
ring 0.17.10 0.17.12 rust-crate GHSA-4p46-pwfr-66x6 MediumListing Components
The purpose of a Bill of Materials is to catalogue components of a product. BOMnipotent Client can be used to list all packages etc. contained in any product that is accessible to your user account. Simply call the client with the arguments “component”, “list”, and then name and version of the product:
bomnipotent_client component list vulny 0.1.0
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Name │ Version │ Type │ CPE │ PURL │
├──────────────┼─────────┼─────────┼───────────────────────────┼───────────────────────────┤
│ aho-corasick │ 1.1.3 │ library │ cpe:2.3:a:aho-corasick:ah │ pkg:cargo/aho-corasick@1. │
│ │ │ │ o-corasick:1.1.3:*:*:*:*: │ 1.3 │
│ │ │ │ *:*:* │ │
│ aws-lc-rs │ 1.12.2 │ library │ cpe:2.3:a:aws-lc-rs:aws-l │ pkg:cargo/aws-lc-rs@1.12. │
│ │ │ │ c-rs:1.12.2:*:*:*:*:*:*:* │ 2 │
│ aws-lc-sys │ 0.25.0 │ library │ cpe:2.3:a:aws-lc-sys:aws- │ pkg:cargo/aws-lc-sys@0.25 │
│ │ │ │ lc-sys:0.25.0:*:*:*:*:*:* │ .0 │
│ │ │ │ :* │ │
│ bindgen │ 0.69.5 │ library │ cpe:2.3:a:bindgen:bindgen │ pkg:cargo/bindgen@0.69.5 │
│ │ │ │ :0.69.5:*:*:*:*:*:*:* │ │
...This output is primarily meant to be human-readable. Using the --output=raw option makes it machine-readable in principle, but
downloading the complete BOM
is most likely preferable to parsing this table output.
A vendor of a product should periodically scan the BOM of a product for vulnerabilities, for example by using tools like grype . The next section explains how you as the user of a product can access these list.
Listing Vulnerabilities
To dispaly a list of known vulnerabilities affecting a product, call “vulnerability”, “list” and then name and version of the product:
bomnipotent_client vulnerability list vulny 0.1.0
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Version │ Vulnerability │ Description │ Score │ Severity │ TLP │ CSAF Assessment │
├─────────┼─────────┼─────────────────────┼───────────────────────────┼───────┼──────────┼─────────┼─────────────────┤
│ vulny │ 0.1.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
╰─────────┴─────────┴─────────────────────┴───────────────────────────┴───────┴──────────┴─────────┴─────────────────╯Product name and version are optional positional arguments. If you do not provide a version, you will get the output for all versions of the product, and if you do not provide either, the output of all products accessible to you.
bomnipotent_client vulnerability list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Version │ Vulnerability │ Description │ Score │ Severity │ TLP │ CSAF Assessment │
├─────────────┼─────────┼─────────────────────┼───────────────────────────┼───────┼──────────┼─────────┼─────────────────┤
│ BOMnipotent │ 1.0.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
│ vulny │ 0.1.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
╰─────────────┴─────────┴─────────────────────┴───────────────────────────┴───────┴──────────┴─────────┴─────────────────╯The output contains an ID for the vulnerability, a description, and a CVSS value and/or severity if available. It also contains a TLP Classification derived from that of the affected product, and ideally a CSAF Assessment by the vendor.
The CSAF document is a crucial part, because it tells you, the user of the product, how you should react to this supply chain vulnerability. Read the next section to find out how to access them.
CSAF Documents
When a vulnerability becomes known in one of the components of a product that you use, one of the most natural questions to ask is “What do I have to do now?”. The Common Security Advisory Format (CSAF) aims to provide an answer to that question in an automated fashion. It is a mainly machine-readable format for exchanging advisories about security vulnerabilities.
One of the main functionalities of BOMnipotent is to make distribution of CSAF documents as easy as possible. Any running instance of BOMnipotent Server acts as a “CSAF Provider” according to the OASIS standard .
List
Running
./bomnipotent_client csaf listwill give you a list of all CSAF documents accessible to you.
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ ID │ Title │ Initial Release │ Current Release │ Status │ TLP │
├───────────────┼───────────────────────────┼──────────────────────┼──────────────────────┼────────┼───────────┤
│ BSI-2022-0001 │ CVRF-CSAF-Converter: XML │ 2022-03-17 13:03 UTC │ 2022-07-14 08:20 UTC │ final │ TLP:WHITE │
│ │ External Entities Vulnera │ │ │ │ │
│ │ bility │ │ │ │ │
╰───────────────┴───────────────────────────┴──────────────────────┴──────────────────────┴────────┴───────────╯Accesible CSAF documents are those that are either labeled TLP:WHITE/TLP:CLEAR, or that concern a product that you have been granted access to.
Download
To locally mirror all CSAF documents accessible to you, run
bomnipotent_client csaf download ./csaf
[INFO] Storing CSAF documents under ./csafThis will store th CSAF documents in the provided folder ("./csaf", in this example). It will create the folder structure if it does not already exist. The CSAF documents are stored in file paths following the naming scheme {tlp}/{initial_release_year}/{csaf_id}.json.
The filenames of CSAF documents follow a naming scheme defined by the OASIS standard : The ids are converted into lowercase, and most special characters are replaced by an underscore ‘_’. This means that, in principle, different CSAF documents could lead to the same filepath. In that case, BOMnipotent will display an error instead of silently overwriting a file.
tree ./csaf/
./csaf/
└── white
  └── 2022
    └── bsi-2022-0001.jsonBefore requesting files for download, BOMnipotent Client makes an inventory of the CSAF documents already present in the folder, and downloads only the missing ones.
It is possible to only download a single file by providing the path as an additional argument:
bomnipotent_client csaf download ./csaf white/2022/bsi-2022-0001.jsonBOMnipotent does not automatically replace existing files, even if they have changed on the server. It instead prints a warning message:
[WARN] File ./csaf/white/2023/wid-sec-w-2023-0001.json already exists.
Use the "--overwrite" flag to replace it.
Skipping download to prevent data loss.You can tell BOMnipotent that you really want this file overwritten by using the “–overwrite” flag:
bomnipotent_client csaf download ./csaf --overwritebomnipotent_client csaf download ./csaf -oGet
You can directly display the contents of a single CSAF doc to the consolte output by calling
bomnipotent_client csaf get <ID>
{
"document" : {
"aggregate_severity" : {
"text" : "mittel"
},
"category" : "csaf_base",
"csaf_version" : "2.0",
"distribution" : {
"tlp" : {
"label" : "WHITE",
...This is especially useful if you want to use the contents of this CSAF doc in a script.
Listing Products
To see exactly which products are covered by a CSAF advisory, run:
./bomnipotent_client product list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Vulnerability │ Status │ CSAF ID │ TLP │
├───────────────────────────┼────────────────┼────────────────┼───────────────┼───────────┤
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ known_affected │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-alpha │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ known_affected │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-dev1 │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ known_affected │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-dev2 │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ known_affected │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-dev3 │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ known_affected │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-rc1 │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ first_fixed │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-rc2 │ │ │ │ │
│ CSAF Tools CVRF-CSAF-Conv │ CVE-2022-27193 │ fixed │ BSI-2022-0001 │ TLP:WHITE │
│ erter 1.0.0-rc2 │ │ │ │ │
╰───────────────────────────┴────────────────┴────────────────┴───────────────┴───────────╯For Managers
This section is aimed at managers of some part of a BOMnipotent system. A manager in this context means a user account that has the permissions to upload or modify supply chain security documents, or to manage access permissions of other users.
Subsections of For Managers
Managing Subscriptions
Most actions that add data to your BOMnipotent database require an active subscription, while reading and removing data do not. This policy ensures that your users do not loose access to the existing data should you one day choose to stop paying for the product.
Commercial entities like companies can acquire a subscription on bomnipotent.de . If you are a non-commercial entity, you can use BOMnipotent without any charge. Request access by sending an email to info@wwh-soft.com .
This page describes how you can use BOMnipotent Client and your subscription key to (de)activate an instance of BOMnipotent Server. The subscription itself, meaning payment, validation and trialing are all handled by the external company Paddle. Describing the management of these aspects would be beyond the scope of this documentation. Please refer to their help page if you require assistance.
Shortly after you have acquired a subscription, you will receive an email containing your subscription key.
Subscriptions can only be managed by a user with the “admin” role.
Activating
To activate your new subscription, simply call:
bomnipotent_client subscription activate <YOUR-SUBSCRIPTION-KEY>
[INFO] Successfully stored subscription key.The server will tell you if something goes wrong during activation:
[ERROR] Received response:
404 Not Found
Failed to activate subscription key: The subscription is missing in the sever database. Please visit https://www.wwh-soft.com to acquire it.Status
To get more information about your current subscription, call:
bomnipotent_client subscription status
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Key │ Product │ Subscription Status │ Valid Until │ Last Updated │ Assessment │
├──────────┼─────────────┼─────────────────────┼─────────────────────────┼─────────────────────────┼───────────────────────────┤
│ ***ccfb3 │ BOMnipotent │ active │ 2025-04-10 17:26:29 UTC │ 2025-03-10 16:26:29 UTC │ The subscription is valid │
│ │ │ │ │ │ . │
╰──────────┴─────────────┴─────────────────────┴─────────────────────────┴─────────────────────────┴───────────────────────────╯This output contains an obfuscated print of your key, a status, and some additional information.
Removing
If you want to remove your subscription from an instance of BOMnipotent Server (because you for example want to use it for another instance), call
bomnipotent_client subscription remove <YOUR-SUBSCRIPTION-KEY>
[INFO] Subscription key was removedTo avoid accidently deactivating a BOMnipotent Server instance that you have admin access to, this requires the correct key as an argument.
[ERROR] Received response:
403 Forbidden
Subscription key does not match stored keyDocument Management
BOMnipotent knows two types of supply chain security documents: Bills of Materials (BOMs) and Common Security Advisory Format (CSAF) documents. In addition, it can host information on vulnerabilities associated with a BOM.
A typical document management workflow looks like this:
- A new version of a product is released, together with its corresponding BOM. The BOM may for example be generated with syft . This document is uploaded to the server. In contrast to the other documents, BOMs should be treated as static data. Modifying or deleting BOMs is possible, but rare.
- An automated tooling or script regularly downloads the BOMs, and checks them for vulnerabilities. This may for example be done with grype . The findings are updated on the server.
- Another tooling or script regularly checks the BOMnipotent Server for new vulnerabilities and sounds an alarm when it finds one. A human mind is needed!
- The human thoroughly analyses the vulnerability and determines if and how your customers have to react. They create a CSAF document, using for example secvisogram . The CSAF document is uploaded to BOMnipotent Server.
- Your consumers will now find the new CSAF document when they poll your instance of BOMnipotent Server.
Subsections of Document Management
BOMs
Bills of Materials stand at the forefront of both BOMnipotents functionality and name. A BOM is a list of all components that make up a product. In the context of cybersecurity, the most prominent variant is the Software Bill of Materials (SBOM), but BOMs allow for more general considerations as well.
For BOM interactions beyond reading, you need the BOM_MANAGEMENT permission. The section about Access Management describes how it is granted.
Uploading
To upload a BOM, call:
bomnipotent_client bom upload <PATH/TO/BOM>BOMnipotent expects its BOMs in the structured CycloneDX JSON format.
Consult the Syft tutorial to learn how to generate a BOM for your product.
The BOMnipotent Client will read the file at the provided path and upload its content. It can then be viewed by the consumers with appropriate permissions.
BOMs for Consumers describes how to list and download the BOMs on the server.
To add a BOM to the database, the BOMnipotent Client has to have some additional information: a name, a version, and optionally a TLP label. The identifiers name and version can either be inferred (recommended), or overwritten, as described below.
Name and Version
BOMnipotent uses name and version to identify a BOM. It tries to infer these from the provided CycloneDX JSON fields “metadata.component.name” and “metadata.component.version”. However, according to the CycloneDX specification , the metadata.component field is optional.
If no version is specified, BOMnipotent instead uses the date of “metadata.timestamp”, if available.
To avoid any complications, it is recommended that you specify a name and version when generating the BOM, as is shown in the Syft tutorial .
If for some reason your BOM lacks a name or version, or if it is incorrect, the BOMnipotent Client offers to remedy that via command line arguments:
bomnipotent_client bom upload <PATH/TO/BOM> --name-overwrite=<NEW-NAME> --version-overwrite=<NEW-VERSION>bomnipotent_client bom upload <PATH/TO/BOM> -n <NEW-NAME> -v <NEW-VERSION>Important: The BOMnipotent Client will in this case modify the data before sending it to the server. It does not modify the local file, as that would be overstepping. This means that your local file and the data on the server are now out-of-sync. What’s maybe worse, if you signed your BOM, your signature is now invalid.
If you do use this option, it is thus recommended that you immediately download the BOM from the server (as described in BOMs for Consumers ) and replace your local file with the result.
TLP Classification
For consumers, BOMnipotent manages access to data using the Traffic Light Protocol (TLP) . The CycloneDX Format on the other hand does not currently support document classification.
To tell BOMnipotent how to classify a document, you have two options:
- Set a default TLP Label in the server config. This will then be used for all BOMs without further specifications.
- Provide a tlp classification via command line argument:
bomnipotent_client bom upload <PATH/TO/BOM> --tlp=<LABEL>bomnipotent_client bom upload <PATH/TO/BOM> -t <LABEL>
If you do neither, BOMnipotent will treat any unclassified documents as if they were labelled TLP:RED, and will log a warning every time it has to do that.
Modifying
In the simplest case, modifying an existing BOM works very much like uploading a new one.
bomnipotent_client bom modify <PATH/TO/BOM>This will infer the name and version from the document, and overwrite the existing content on the server. If the data does not exist on the server, it will return a 404 Not Found error.
Modifying TLP Label
If a TLP label had previously been assigned to the BOM, a modification of the contents will not automatically alter it.
If you want to specify a new TLP label, you can do so via argument:
bomnipotent_client bom modify <PATH/TO/BOM> --tlp=<LABEL>bomnipotent_client bom modify <PATH/TO/BOM> -t <LABEL>If the contents of the BOM have not changed and you just want to modify the TLP label, you do not need to upload the document again. Instead of providing a path to a file, you can specify name and version of the BOM you want to reclassify:
bomnipotent_client bom modify --name=<NAME> --version=<VERSION> --tlp=<LABEL>bomnipotent_client bom modify -n <name> -v <version> -t <label>If you specify “none”, “default” or “unlabelled” as the TLP label, any existing classification will be removed, and the server falls back to the default TLP Label of the server config:
bomnipotent_client bom modify <PATH/TO/BOM> --tlp=none
bomnipotent_client bom modify <PATH/TO/BOM> --tlp=default # Does the same
bomnipotent_client bom modify <PATH/TO/BOM> --tlp=unlabelled # Does the samebomnipotent_client bom modify <PATH/TO/BOM> -t none
bomnipotent_client bom modify <PATH/TO/BOM> -t default # Does the same
bomnipotent_client bom modify <PATH/TO/BOM> -t unlabelled # Does the sameModifying Name or Version
If the document you are uploading has a different name or version than the data it shall modify, you need to provide that information to the BOMnipotent Client using command line arguments:
bomnipotent_client bom modify <PATH/TO/BOM> --name=<OLD-NAME> --version=<OLD-VERSION>bomnipotent_client bom modify <PATH/TO/BOM> -n <OLD-NAME> -v <OLD-VERSION>BOMnipotent will infer the new data from the document you provide and change the database entries accordingly.
Overwriting Name or Version (not recommended)
As with uploading, it is possible to overwrite the name and/or version stored in the local document:
bomnipotent_client bom modify <PATH/TO/BOM> --name-overwrite=<NEW-NAME> --version-overwrite=<NEW-VERSION>Important: As with uploading, this modifies the JSON data before uploading to the server! The same caveats apply.
If the data on the server has a different name and/or version than specified in the document, you can combine the specification with an overwrite of the data:
bomnipotent_client bom modify <PATH/TO/BOM> --name=<OLD-NAME> --version=<OLD-VERSION> --name-overwrite=<NEW-NAME> --version-overwrite=<NEW-VERSION>bomnipotent_client bom modify <PATH/TO/BOM> -n <OLD-NAME> -v <OLD-VERSION> --name-overwrite=<NEW-NAME> --version-overwrite=<NEW-VERSION>Changing name and/or version without providing the complete document is not supported.
Deleting
Deleting a BOM is very straightforward:
bomnipotent_client bom delete <NAME> <VERSION>If the BOM does not exist, the server will return 404 Not Found. If it does exists, it is removed from the database.
Vulnerabilities
An activity at the core of supply chain security is to compare the contents of a BOM, meaning all components of a product, to databases of known vulnerabilities.
For vulnerability interactions beyond reading, you need the VULN_MANAGEMENT permission. The section about Access Management describes how it is granted.
Detecting
BOMnipotent does not itself detect new vulnerabilities. One tool that can be used in combination with BOMnipotent is grype , which takes a BOM as input and produces a list of vulnerabilities as output. The grype tutorial contains some additional information on its usage. Other tools can be used as long as they provide output in CycloneDX JSON format .
Using the BOMnipotent Client, you can directly print the contents of a BOM and pipe it to grype.
bomnipotent_client bom get <BOM-NAME> <BOM-VERSION> | grype --output cyclonedx-json=./vuln.cdx.jsonbomnipotent_client bom get <BOM-NAME> <BOM-VERSION> | grype -o cyclonedx-json=./vuln.cdx.jsonThis will check the software components agains several databases and add the result to the CycloneDX. It then stores all that in a file called “vuln.cdx.json” (or whichever other name you provide).
Grype currently has a small known bug that makes it forget the version of the main component when it adds the vulnerabilities. This is a bit problematic because BOMnipotent needs the version to uniquely identify a product. One possible workaround is to re-add the version to the document, for example via
jq '.metadata.component.version = "<VERSION>"' "vuln.cdx.json" > "vuln_with_version.cdx.json". Starting with BOMnipotent v0.3.1 you can instead directly provide the version during the vulnerability upload, as described below.
Updating
The command to update the vulnerabilities associated with a BOM is
bomnipotent_client vulnerability update <VULNERABILITIES>
[INFO] Updated vulnerabilities of BOM vulny_0.1.0The “<VULNERABILITIES>” argument needs to be a path to a file in CycloneDX JSON format.
Ideally, this file contains the name and version of the associated BOM, in which case they will automatically be read. If one of the values is missing (due to a known bug in grype, for example), you can provide it with an optional argument:
bomnipotent_client vulnerability update <VULNERABILITIES> --name=<NAME> --version=<VERSION>bomnipotent_client vulnerability update <VULNERABILITIES> -n <NAME> -v <VERSION>
[INFO] Updated vulnerabilities of BOM BOMnipotent_1.0.0Vulnerabilities are meant to updated periodically. Doing so will completely replace any previous vulnerabilities associated a BOM. The uploaded CycloneDX document thus needs to contain a full list of all known vulnerabilities.
You can only update vulnerabilities for a BOM that exists on the server:
[ERROR] Received response:
404 Not Found
BOM Schlagsahne_1.0.1 not found in databaseListing
The section about listing vulnerabilities in the documentation for consumers covers most aspects of listing vulnerabilities.
One aspect not mentioned there is the “–unassessed” option. With it, BOMnipotent Client lists only those vulnerabilities that have no CSAF document associated with it.
bomnipotent_client vulnerability list --unassessedbomnipotent_client vulnerability list -u
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Product │ Version │ Vulnerability │ Description │ Score │ Severity │ TLP │ CSAF Assessment │
├─────────────┼─────────┼─────────────────────┼───────────────────────────┼───────┼──────────┼─────────┼─────────────────┤
│ BOMnipotent │ 1.0.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
│ vulny │ 0.1.0 │ GHSA-qg5g-gv98-5ffh │ rustls network-reachable │ │ medium │ Default │ │
│ │ │ │ panic in `Acceptor::accep │ │ │ │ │
│ │ │ │ t` │ │ │ │ │
╰─────────────┴─────────┴─────────────────────┴───────────────────────────┴───────┴──────────┴─────────┴─────────────────╯
[ERROR] Found 2 unassessed vulnerabilities.In this mode, BOMnipotent Client exits with a code indicating an error if and only if there are unassessed vulnerabilites. This makes it easy to integrate this call in your periodic CI/CD.
You can freely combine this option with specifying a product name or version:
bomnipotent_client vulnerability list <NAME> <VERSION> --unassessedbomnipotent_client vulnerability list <NAME> <VERSION> -u
[INFO] No unassessed vulnerabilities foundCSAF Documents
A Common Security Advisory Format (CSAF) document is a vendor’s response to a newly discovered vulnerability. It is a machine-readable format to spread information on how a user of your product should react: Do they need to update to a newer version? Do they need to modify a configuration? Is your product even truly affected, or does it maybe never call the affected part of the vulnerable library?
For CSAF interactions beyond reading, you need the CSAF_MANAGEMENT permission. The sectino about Access Management describes how it is granted.
Uploading
To upload a CSAF document, call
bomnipotent_client csaf upload <PATH/TO/CSAF>
[INFO] Uploaded CSAF with id WID-SEC-W-2024-3470Before your CSAF document is uploaded, BOMnipotent Client checks that it is valid according to the OASIS CSAF Standard .
You can view the result of the operation with
bomnipotent_client csaf list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ ID │ Title │ Initial Release │ Current Release │ Status │ TLP │
├─────────────────────┼───────────────────────────┼─────────────────────────┼─────────────────────────┼────────┼───────────┤
│ WID-SEC-W-2024-3470 │ binutils: Schwachstelle e │ 2024-11-14 23:00:00 UTC │ 2024-11-17 23:00:00 UTC │ final │ TLP:WHITE │
│ │ rmöglicht Denial of Servi │ │ │ │ │
│ │ ce │ │ │ │ │
╰─────────────────────┴───────────────────────────┴─────────────────────────┴─────────────────────────┴────────┴───────────╯All data is taken from the CSAF document.
If the document does not have the optional TLP label entry, it is treated with the default tlp configured for the server.
...┬────────┬─────────╮
...│ Status │ TLP │
...┼────────┼─────────┤
...│ final │ Default │
...┴────────┴─────────╯Modifying
When the status of your document changes, if you want to reclassify it, or if new information has come to light, you may want to modify your document. To upload the new version, call:
bomnipotent_client csaf delete <PATH/TO/CSAF>
[INFO] Modified CSAF with id BSI-2024-0001-unlabeledThe command can even modify the ID of the CSAF document. Because the old ID cannot be inferred from the new document in that case, it has to be provided as an optional argument:
bomnipotent_client csaf delete <PATH/TO/CSAF> --id=<OLD-ID>bomnipotent_client csaf delete <PATH/TO/CSAF> -i <OLD-ID>Deleting
To delete a CSAF document from your server (which you should really only do if something went completely wrong), simply call:
bomnipotent_client csaf delete <CSAF-ID>
[INFO] Deleted CSAF with id WID-SEC-W-2024-3470Access Management
Supply chain security documents are the what of BOMnipotent, users are the who. Unless you explicitly state otherwise, the hosted documents are only visible to those user accounts you grant access to.
BOMnipotent uses role-based access control (RBAC): Users have roles, and roles have permissions . After setup, BOMnipotent contains a few default roles. These are sufficient for managing the server, but to start accepting user request, you will probably want to create at least one new role.
Once that is done, a typical workflow for introducing a new user to your BOMnipotent system is as follows:
- A new user requests access to your server. During this step, BOMnipotent Client sends a public key associated with the account to your server, where it is stored and marked as “requested”.
- You approve the request. The new user account is now accepted as valid, but it does not have any permissions yet.
- You assign one or more roles to the new user account.
Subsections of Access Management
Permissions
In BOMnipotent, permissions are not directly associated with user accounts, but rather with roles. The section about role management covers how this association is managed, and the section about role assignment explains how roles (and thus ultimately permissions) are assigned to users.
The server has several permissions embedded in its code, some of which are hardcoded, some of which are configurable, and all of which are explained here. To learn how to actually create a permission associated with a role, please refer to the section dedicated to exactly that topic.
The permissions can mentally be split into permissions associated with consumers , managers , and some special tasks reserved for admins.
Consumer Permissions
Your customers are typically associated with one or more of your products. They will want to view all types of documents and information for that particular product, but they are not automatically entitled to information about other products.
PRODUCT_ACCESS
A permission with the value “PRODUCT_ACCESS(<PRODUCT>)” grants read permissions to any document associated with “<PRODUCT>”. This includes any BOM for that product, any vulnerabilities associated with these BOMs, and any CSAF documents covering this product.
For example, a role with the “PRODUCT_ACCESS(BOMnipotent)” could view (and only view) all documents associated with BOMnipotent.
It is possible to use the asterisk operator “*” to glob product names. In that case, the asterisk matches an arbitrary number of symbols. For example, the permission “PRODUCT_ACCESS(BOM*ent)” would match “BOMnipotent” as well as the (fictional) products “BOMent” and “BOM-burárum-ent”, but not “BOMtastic” (because the latter does not end on “ent”).
Consequently, “PRODUCT_ACCESS(*)” allows the viewing of all documents.
Manager Permissions
For managers of documents, the situation is usually reversed: They need the permission to not only view but also modify the contents in the database. Their scope is typically not restricted to a specific product, but instead to a specific type of document. This is why the segregation of manager permissions takes another perspective.
BOM_MANAGEMENT
This permission allows the uploading, modifying and deleting of Bills of Materials (BOMs). It also automatically grants permission to view all hosted BOMs.
VULN_MANAGEMENT
This permission allows to update and view the list of vulnerabilities associated with any BOM.
CSAF_MANAGEMENT
Unsurprisingly, this permission allows the uploading, modifying and deleting of Common Security Advisory Format (CSAF) documents. It also automatically grants view permissions to all hosted CSAF documents.
ROLE_MANAGEMENT
With this permission, a user can modify the permissions of roles, which can have far reaching consequences, because the changes potentially affect many users.
USER_MANAGEMENT
This permission is required to approve, deny or view users, or to individually assign roles to them.
Special Admin permissions
BOMnipotent knows one hardcoded special role called “admin”. This role always has all permissions that can be given to users. Additionally, there are some tasks that can only be done by a user with the admin role:
- Only admins can give or remove the admin role to or from other users. A special tmp admin mechanism exists to create the first admin for a freshly created BOMnipotent Server.
- Only admins can (de)activate the subscription key for a BOMnipotent Server instances.
Role Management
BOMnipotent uses a role-based access model (RBAC), in which users are associated with roles, and roles with permissions. While permissions are largely hardcoded into BOMnipotent, roles can be managed (almost) freely. This section explains how to do that.
To modify or even view roles and their permissions, your user account needs the ROLE_MANAGEMENT permission.
Default Roles
When you spin up your BOMnipotent Server for the first time, it creates several colourfully named default roles in the database:
- “bom_manager”, with the BOM_MANAGEMENT permission.
- “csaf_manager”, with the CSAF_MANAGEMENT permission.
- “role_manager”, with the ROLE_MANAGEMENT permission.
- “user_manager”, with the USER_MANAGEMENT permission.
- “vuln_manager”, with the VULN_MANAGEMENT permission.
You can modify or delete these roles at will, they are merely suggestions.
If you do not like these roles, use the following calls to delete them:
bomnipotent_client role-permission remove bom_manager BOM_MANAGEMENT;
bomnipotent_client role-permission remove csaf_manager CSAF_MANAGEMENT;
bomnipotent_client role-permission remove role_manager ROLE_MANAGEMENT;
bomnipotent_client role-permission remove user_manager USER_MANAGEMENT;
bomnipotent_client role-permission remove vuln_manager VULN_MANAGEMENT;Admin Role
There is a special role called “admin”, which is not listed among the other roles. The reason is that it is not part of the database, but of the BOMnipotent code itself. As such, it cannot be modified.
bomnipotent_client role-permission remove admin BOM_MANAGEMENTbomnipotent_client role-permission add admin "PRODUCT_ACCESS(BOMnipotent)"
[ERROR] Received response:
422 Unprocessable Entity
Cannot modify admin role permissionsThe admin role has all permissions that can be granted, and then some more .
Listing
To list all roles and their associated permissions, call:
bomnipotent_client role-permission list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Role │ Permission │ Last Updated │
├──────────────┼─────────────────┼───────────────────────────┤
│ bom_manager │ BOM_MANAGEMENT │ 2025-03-20 10:38:27.29648 │
│ │ │ 0 UTC │
│ csaf_manager │ CSAF_MANAGEMENT │ 2025-03-20 10:38:27.29695 │
│ │ │ 2 UTC │
│ role_manager │ ROLE_MANAGEMENT │ 2025-03-20 10:38:27.29621 │
│ │ │ 3 UTC │
│ user_manager │ USER_MANAGEMENT │ 2025-03-20 10:38:27.29562 │
│ │ │ 0 UTC │
│ vuln_manager │ VULN_MANAGEMENT │ 2025-03-20 10:38:27.29671 │
│ │ │ 9 UTC │
╰──────────────┴─────────────────┴───────────────────────────╯Adding
Because roles without permissions are meaningless, the two always come in pairs. There is no dedicated mechanism to create a new role: rather, you add a permission to a role, and henceforth it exists.
The syntax to add a permission to a role is
bomnipotent_client role-permission add <ROLE> <PERMISSION>
[INFO] Added permission BOM_MANAGEMENT to roleYou could for example unify several permissions into the roles “doc_manager” and “access_manager”:
bomnipotent_client role-permission add doc_manager BOM_MANAGEMENT;
bomnipotent_client role-permission add doc_manager CSAF_MANAGEMENT;
bomnipotent_client role-permission add doc_manager VULN_MANAGEMENT;
bomnipotent_client role-permission add access_manager ROLE_MANAGEMENT;
bomnipotent_client role-permission add access_manager USER_MANAGEMENT;If you have removed the default roles as described above, this leaves you with:
bomnipotent_client role-permission list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ Role │ Permission │ Last Updated │
├────────────────┼─────────────────┼───────────────────────────┤
│ access_manager │ ROLE_MANAGEMENT │ 2025-03-20 11:05:42.06443 │
│ │ │ 7 UTC │
│ access_manager │ USER_MANAGEMENT │ 2025-03-20 11:04:57.51274 │
│ │ │ 7 UTC │
│ doc_manager │ BOM_MANAGEMENT │ 2025-03-20 11:05:55.15986 │
│ │ │ 0 UTC │
│ doc_manager │ CSAF_MANAGEMENT │ 2025-03-20 11:05:50.92466 │
│ │ │ 9 UTC │
│ doc_manager │ VULN_MANAGEMENT │ 2025-03-20 11:05:47.35620 │
│ │ │ 9 UTC │
╰────────────────┴─────────────────┴───────────────────────────╯If the permission you want to add does not exist or is malformed, you will receive an error:
bomnipotent_client role-permission add clam_manager CLAM_MANAGEMENT
[ERROR] Received response:
422 Unprocessable Entity
Failed to parse permission: Invalid UserPermission string: CLAM_MANAGEMENTRemoving
To remove a permission from a role, simply call:
bomnipotent_client role-permission remove <ROLE> <PERMISSION>
[INFO] Removed permission VULN_MANAGEMENT from role vuln_managerOnce you have removed the last role from a permission, that role does no longer exist.
To prevent oopsie-moments, BOMnipotent does not support deleting whole batches of role-permissions.
User Management
The first step when creating a new user is to request a new account. This step is described elsewhere , because it is relevant for managers and consumers alike.
From BOMnipotent’s point of view, a user is associated with a unique email address, which is used as an identifier, and a public key, which is used for authentication. This is all the data sent during the creation of a new user account.
After a new account has been requested, it is up to a user manager to approve or deny the request.
For most user interactions, including listing, you need the USER_MANAGEMENT permission.
Listing
To list all users in your database, call
bomnipotent_client user list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ User Email │ Status │ Expires │ Last Updated │
├────────────────────┼───────────┼─────────────────────────┼─────────────────────────┤
│ admin@wwh-soft.com │ APPROVED │ 2026-03-23 04:51:26 UTC │ 2025-03-22 04:51:26 UTC │
│ info@wildeheide.de │ REQUESTED │ 2026-03-23 03:52:21 UTC │ 2025-03-22 03:52:21 UTC │
╰────────────────────┴───────────┴─────────────────────────┴─────────────────────────╯You can see the email addresses of the users and their stati.
A user that does not have the status APPROVED has no special permissions, no matter which roles they have.
An expiration date is also associated with each user, which is the point in time at which the public key is considered invalid and has to be renewed. The period for which a key is considered valid can be freely configured in the server config.
Approval or Denial
If you were expecting the user request, you can approve it via
bomnipotent_client user approve <EMAIL>
[INFO] Changed status of info@wildeheide.de to APPROVEDAnalogously, you can decide agains allowing this user any special access:
bomnipotent_client user deny <EMAIL>
[INFO] Changed status of info@wildeheide.de to DENIEDIt is possible to deny a user that has already been approved, effectively revoking the account.
Deleting
If you want to get rid of a user account alltogether, call
bomnipotent_client user remove <EMAIL>
[INFO] Deleted user info@wildeheide.deRole Assignment
Roles are what connects users to permissions. Adding or removing roles to and from users indirectly controls to what extend users can interact with your BOMnipotent Server instance.
For your convenience, several default roles are created upon starting BOMnipotent Server for the first time. In addition, BOMnipotent knows of the admin role , which receives some special treatment.
To modify or even view user roles, your user account needs the USER_MANAGEMENT permission.
Listing
To list all roles of all users, call
bomnipotent_client user-role list
â•â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”¬â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â”€â•®
│ User Email │ User Role │ Last Updated │
├──────────────────┼─────────────┼───────────────────────────┤
│ info@quantumwire │ bom_manager │ 2025-03-22 04:27:33.71579 │
│ │ │ 7 UTC │
│ info@wildeheide │ bom_manager │ 2025-03-22 04:26:08.83708 │
│ │ │ 3 UTC │
╰──────────────────┴─────────────┴───────────────────────────╯Adding
To add a new role to a user, call
bomnipotent_client user-role add <EMAIL> <ROLE>
[INFO] Added role to userThe user account needs to exist on the server at this point, the role does not.
Only users with the admin role can add the admin role to other users.
Removing
To remove a role from a user, call
bomnipotent_client user-role remove <EMAIL> <ROLE>
[INFO] Removed role bom_manager from user info@wildeheideThis will show an error if either does not exist:
[ERROR] Received response:
404 Not Found
User with email info@wildeheide does not have role bom_managerOnly users with the admin role can remove the admin role from other users.
Changelog
These pages list all changes introduced to BOMnipoten Server and Client by various versions. The versions follow semantic versioning , meaning that all version have the form MAJOR.MINOR.PATCH, and
- the MAJOR version is increased when there is a breaking change for the user. Which ideally never happens.
- the MINOR version is increased for new, non-breaking features.
- the PATCH version is increased for bug fixes.
- a MAJOR version of 0 is used during the betaphase. Here everything shifts to the right: a new MINOR versions means a breaking change, and a new PATCH version any non-breaking change.
It is recommended to always use the latest version.
Subsections of Changelog
0.4.0 (2025-03-24)
BREAKING
- User accounts now need to exist before they can be assigned any role.
- Explicitly providing an id when modifying a CSAF document is now optional.
- Overhauled logging:
- The option “–output-mode” / “-o” now only takes values “normal”, “code” and “raw”.
- New option “–log-level” / “-l” takes “error”, “warn”, etc.
- Log file is now specified via “–log-file” / “-f”.
- Streamlined which combination logs how much to which output.
- The “raw” output mode now processes the data like everyone else.
Changed
- During download, the new flag “–overwrite” allows to locally overwrite BOM and CSAF documents that have been modified on the server.
Fixed
- The server can now handle the case where an uploaded BOM contains several vulnerabilities with the same ID.
0.3.1 (2025-03-17)
Added
- Implemented “bom get” and “csaf get” command to print the contents of a single document directly to stdout. This makes it easier to integrate BOMnipotent into scripting.
- Added options “–name” and “–version” to “vulnerability update” command, allowing to provide or overwrite the name or version of the corresponding product.
Changed
- The output of “subscription status” now contains the proper name of the product instead of the (internal) product id.
Workflow Integration
Once the BOMnipotent Server is up and running, you can begin uploading documents. A typical workflow begins with generating an SBOM, an inventory of what components your product contains. This step should be automatically triggered upon creating a new release. Then this inventory is scanned for known vulnerabilities. This should also be an automatic step, but it should be triggered periodically. If a vulnerability is discovered, it is time to analyse it. This task needs expertise, and thus cannot be done automatically. The result of this analysis is a CSAF document, which tells your users if and how they have to react to this new development.
This section contains instructions for an exemplary workflow for generating an SBOM using Syft , scanning it for vulnerabilities with Grype , and creating CSAF documents with secvisogram . Other programs exists for these tasks, and as long as they produce valid CycloneDX and CSAF json documents, they are compatible with BOMnipotent.
Subsections of Workflow Integration
SBOM Generation with Syft
A Software Bill of Material (SBOM) is a list of all software components used in your product. In the contex of supply chain security, it serves as a machine-readable list of items to compare to whenever a new vulnerability surfaces.
Several tools exist to automatically generate such an SBOM. This tutorial focuses on Anchore’s Syft, an open source command line tool.
Setup
The official Syft GitHub repo contains installation instructions. It is available via a shell script or via various package managers.
On some linux systems you may want to change the install path (the very last argument to the shell command) to “~/.local/bin”, because “/usr/local/bin” requires root permissions to modify.
Usage
The basic usage of Syft is:
syft <target> [options]Additionally, some configuration can be made using environment variables.
Syft supports lockfiles, directories, container images and more as targets.
Lockfile
An example call looks like this:
SYFT_FORMAT_PRETTY=1 syft Cargo.lock --output cyclonedx-json=./sbom.cdx.json --source-name="BOMnipotent" --source-version="1.0.0"SYFT_FORMAT_PRETTY=1 syft Cargo.lock -o cyclonedx-json=./sbom.cdx.json --source-name="BOMnipotent" --source-version="1.0.0"- ‘SYFT_FORMAT_PRETTY=1’ is makes this call with an environment variable that tells Syft to use prettified output. This only serves to make the resulting json easier readable for humans. See here for a full list of configurations.
- ‘syft’ cals the Syft program.
- ‘Cargo.lock’ tells Syft to analyse the lockfile of the Rust ecosystem.
- ‘–output cyclonedx-json=./sbom.cdx.json’ specifies that the output is to be stored in the
CycloneDx
JSON format in the file ‘./sbom.cdx.json’.
- Note that ‘.cdx.json’ is the recommended file extension .
- ‘–source-name=“BOMnipotent”’ explains to Syft that these are the sources for the BOMnipotent component, which it may not automatically detect in all cases.
- The CycloneDX schema may not require a component name, but BOMnipotent does.
- Likewise ‘–source-version=“1.0.0”’ tells Syft the current version of your project.
- If you do not provide a version, BOMnipotent will try to use the timestamp as a version string instead.
Syft supports a wide range of ecosystems, which is listed on their GitHub repo .
Directory
Letting Syft loose on a whole directory is possible, but overdoes it in most situations. It will go through all subdirectories and collect everything that looks remotely like a lockfile, including all your test dependencies, development scripts and GitHub Actions.
syft . --output cyclonedx-json=./dev_env_sbom.cdx.json --source-name="BOMnipotent Development Environment" --source-version=1.2.3syft . -o cyclonedx-json=./dev_env_sbom.cdx.json --source-name="BOMnipotent Development Environment" --source-version=1.2.3Container
If you have a docker container exported as a ‘.tar’ file you can also specify that as a target:
syft container.tar --output cyclonedx-json=./container_sbom.cdx.json --source-name="BOMnipotent Container" --source-version=1.2.3syft container.tar -o cyclonedx-json=./container_sbom.cdx.json --source-name="BOMnipotent Container" --source-version=1.2.3For compiled languages the results will be vastly different, because most information about the components that went into compilation is lost. On the other hand, this SBOM contains information about the environment that your product may later run in.
Final remarks
When deciding on a target, it is important to think about the scope of your application: What do you ship to the customer? Up to which extend are you responsible for the supply chain of your product? If in doubt, there’s no harm in uploading more than one variant of a BOM, as long as product name or version are different.
Once your SBOM is generated, you can use BOMnipotent Client to upload it to BOMnipotent Server .
After that you can use Grype to periodically scan for vulnerabilities .
Vulnerability Detection with Grype
Once your SBOM is generated, it is time to continuously scan it for vulnerabilities. Note that some laws, for example the EU’s Cyber Resiliance Act, require that products are released without any known vulnerability. The first scan should therefore happen before a release.
There are several tools for scanning a product for supply chain vulnerabilities. This tutorial uses Anchore’s Grype, because it integrates well with Anchore’s Syft from the SBOM tutorial . Like Syft, Grype is an open source command line utility.
Setup
The official Grype GitHub repo contains installation instructions. Like for Syft, you may want to change the install path (the very last argument to the shell command) to ‘~/.local/bin’, because ‘/usr/local/bin’ requires root permissions to modify.
Usage
With an SBOM at hand, scanning for vulnerabilities is very easy:
grype sbom:./sbom.cdx.json --fail-on lowgrype sbom:./sbom.cdx.json -f low
✔ Scanned for vulnerabilities [2 vulnerability matches]
├── by severity: 0 critical, 0 high, 2 medium, 0 low, 0 negligible
└── by status: 2 fixed, 0 not-fixed, 0 ignored
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
ring 0.17.8 0.17.12 rust-crate GHSA-4p46-pwfr-66x6 Medium
rustls 0.23.15 0.23.18 rust-crate GHSA-qg5g-gv98-5ffh Medium
[0000] ERROR discovered vulnerabilities at or above the severity thresholdWhen running this command, Grype checks several vulnerability databases for matches with the components provided in the sbom. The ‘fail-on’ option specifies that it exits with a non-zero error code if any with severity ’low’ or higher is discovered.
The syntax to export a vulnerability report consumable by BOMnipotent is similar to Syft:
grype sbom:./sbom.cdx.json --output cyclonedx-json=./vuln.cdx.jsongrype sbom:./sbom.cdx.json -o cyclonedx-json=./vuln.cdx.jsonGrype integrates well with BOMnipotent. You can use the “bom get” command of BOMnipotent Client to directly print the contents of a BOM to the console output, and then pipe it to grype:
bomnipotent_client bom get <BOM-NAME> <BOM-VERSION> | grype --output cyclonedx-json=./vuln.cdx.jsonbomnipotent_client bom get <BOM-NAME> <BOM-VERSION> | grype -o cyclonedx-json=./vuln.cdx.jsonLegal Stuff
This section contains several texts necessary to be compliant with various laws and regulations.
Subsections of Legal Stuff
OSS Licenses
BOMnipotent is based on numerous open source software projects. Several (though not all) of these are licensesd under terms requiring that the full license text be listed in the documentation. This page serves to fulfil that promise.
Privacy Policy
Powered by Termly
Last updated February 23, 2025
This Privacy Notice for Weichwerke Heidrich Software (’we’, ‘us’, or ‘our’), describes how and why we might access, collect, store, use, and/or share (’process’) your personal information when you use our services (’*Services’), including when you:
- Visit our website at doc.bomnipotent.de , or any website of ours that links to this Pricacy Notice
- Engage with us in other related ways, including any sales, marketing or events Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@wwh-soft.com .
SUMMARY OF KEY POINTS
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? Some of the information may be considered ‘special’ or ‘sensitive’ in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.
Do we collect any information from third parties? We do not collect any information from third parties.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.
In what situations and with which parties do we share personal information? We may share information in specific situations and with specific parties.
How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
How do you exercise your rights? The easiest way to exercise your rights is by contacting us via info@wwh-soft.com . We will consider and act upon any request in accordance with applicable data protection laws.
TABLE OF CONTENTS
- WHAT INFORMATION DO WE COLLECT?
- HOW DO WE PROCESS YOUR INFORMATION?
- WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
- WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
- HOW LONG DO WE KEEP YOUR INFORMATION?
- HOW DO WE KEEP YOUR INFORMATION SAFE?
- DO WE COLLECT INFORMATION FROM MINORS?
- WHAT ARE YOUR PRIVACY RIGHTS?
- CONTROLS FOR DO-NOT-TRACK FEATURES
- DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
- DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
- DO WE MAKE UPDATES TO THIS NOTICE?
- HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
- HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
- email addresses
Sensitive Information. We do not process sensitive information.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
- To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
- Consent. We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
- Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
- Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
- Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e. express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e. implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We may share information in specific situations described in this section and/or with the following third parties.
We may need to share your personal information in the following situations:
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
5. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
6. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
7. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@wwh-soft.com .
8. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section ‘ HOW CAN YOU CONTACT US ABOUT THIS NOTICE? ’ below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority .
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner .
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section ‘ HOW CAN YOU CONTACT US ABOUT THIS NOTICE? ’ below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
If you have questions or comments about your privacy rights, you may email us at info@wwh-soft.com .
9. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (‘DNT’) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.
10. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
Categories of Personal Information We Collect
We have collected the following categories of personal information in the past twelve (12) months:
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
| B. Personal information as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information | NO |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NO |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | NO |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | Browsing history, search history, online behaviour, interest data, and interactions with our and other websites, applications, systems, and advertisements | NO |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings created in connection with our business activities | NO |
| I. Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | NO |
| J. Education Information | Student records and directory information | NO |
| K. Inferences drawn from collected personal information | Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | NO |
| L. Sensitive personal Information | NO |
We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of our Services and to respond to your inquiries.
We will use and retain the collected personal information as needed to provide the Services or for:
- Category A - 6 months
Sources of Personal Information
Learn more about the sources of personal information we collect in ‘ WHAT INFORMATION DO WE COLLECT? ’
How We Use and Share Personal Information
Learn more about how we use your personal information in the section, ‘ HOW DO WE PROCESS YOUR INFORMATION? ’
Will your information be shared with anyone else?
We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, ‘ WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION? ’
We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be ‘selling’ of your personal information.
We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.
Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (‘profiling’)
Depending upon the state where you live, you may also have the following rights:
- Right to access the categories of personal data being processed (as permitted by applicable law, including Minnesota’s privacy law)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California’s and Delaware’s privacy law)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Minnesota’s and Oregon’s privacy law)
- Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including Minnesota’s privacy law)
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California’s privacy law)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida’s privacy law)
How to Exercise Your Rights
To exercise these rights, you can contact us by emailing us at info@wwh-soft.com , or by referring to the contact details at the bottom of this document.
Under certain US state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at info@wwh-soft.com . We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
California ‘Shine The Light’ Law
California Civil Code Section 1798.83, also known as the ‘Shine The Light’ law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section ‘ HOW CAN YOU CONTACT US ABOUT THIS NOTICE? ’
11. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: You may have additional rights based on the country you reside in.
Australia and New Zealand
We collect and process your personal information under the obligations and conditions set by Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020 (Privacy Act).
This Privacy Notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.
If you do not wish to provide the personal information necessary to fulfil their applicable purpose, it may affect our ability to provide our services, in particular:
- offer you the products or services that you want
- respond to or help with your requests
At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section ‘ HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU? ’
If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand’s Privacy Principles to the Office of New Zealand Privacy Commissioner .
Republic of South Africa
At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section ‘ HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU? ’
If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:
The Information Regulator (South Africa)
General enquiries:Â enquiries@inforegulator.org.za
Complaints (complete POPIA/PAIA form 5):Â PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za
12. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated ‘Revised’ date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email at info@wwh-soft.com , or contact us by post at:
Weichwerke Heidrich Software
Data Protection Officer
Im Hirschmorgen 32
Leimen 69181
Germany
14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at info@wwh-soft.com .
Terms and Conditions
Powered by Termly
Last updated February 22, 2025
AGREEMENT TO OUR LEGAL TERMS
We are Weichwerke Heidrich Software ("Company", “we”, “us”, “our”).
We operate doc.bomnipotent.de , as well as any other related products and services that refer or link to these legal terms (the “Legal Terms”) (collectively, the “Services”).
You can contact us by email at info@wwh-soft.com or by mail to Weichwerke Heidrich Software, Im Hirschmorgen 32, 69181 Leimen, Germany.
These Legal Terms constitute a legally binding agreement made between you, whether personally or on behalf of an entity ("you"), and Weichwerke Heidrich Software, concerning your access to and use of the Services. You agree that by accessing the Services, you have read, understood, and agreed to be bound by all of these Legal Terms. IF YOU DO NOT AGREE WITH ALL OF THESE LEGAL TERMS, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND YOU MUST DISCONTINUE USE IMMEDIATELY.
Supplemental terms and conditions or documents that may be posted on the Services from time to time are hereby expressly incorporated herein by reference. We reserve the right, in our sole discretion, to make changes or modifications to these Legal Terms at any time and for any reason. We will alert you about any changes by updating the “Last updated” date of these Legal Terms, and you waive any right to receive specific notice of each such change. It is your responsibility to periodically review these Legal Terms to stay informed of updates. You will be subject to, and will be deemed to have been made aware of and to have accepted, the changes in any revised Legal Terms by your continued use of the Services after the date such revised Legal Terms are posted.
We recommend that you print a copy of these Legal Terms for your records.
TABLE OF CONTENTS
- OUR SERVICES
- INTELLECTUAL PROPERTY RIGHTS
- USER REPRESENTATIONS
- PROHIBITED ACTIVITIES
- USER GENERATED CONTRIBUTIONS
- CONTRIBUTION LICENSE
- SERVICES MANAGEMENT
- TERM AND TERMINATION
- MODIFICATIONS AND INTERRUPTIONS
- GOVERNING LAW
- DISPUTE RESOLUTION
- CORRECTIONS
- DISCLAIMER
- LIMITATIONS OF LIABILITY
- INDEMNIFICATION
- USER DATA
- ELECTRONIC COMMUNICATIONS, TRANSACTIONS, AND SIGNATURES
- FREE ACCESS TO BOMNIPOTENT FOR NON-COMMERCIAL ENTITIES
- MISCELLANEOUS
- CONTACT US
1. OUR SERVICES
The information provided when using the Services is not intended for distribution to or use by any person or entity in any jurisdiction or country where such distribution or use would be contrary to law or regulation or which would subject us to any registration requirement within such jurisdiction or country. Accordingly, those persons who choose to access the Services from other locations do so on their own initiative and are solely responsible for compliance with local laws, if and to the extent local laws are applicable.
2. INTELLECTUAL PROPERTY RIGHTS
Our intellectual property
We are the owner or the licensee of all intellectual property rights in our Services, including all source code, databases, functionality, software, website designs, audio, video, text, photographs, and graphics in the Services (collectively, the “Content”), as well as the trademarks, service marks, and logos contained therein (the “Marks”).
Our Content and Marks are protected by copyright and trademark laws (and various other intellectual property rights and unfair competition laws) and treaties around the world.
The Content and Marks are provided in or through the Services “AS IS” for your personal, non-commercial use or internal business purpose only.
Your use of our Services
Subject to your compliance with these Legal Terms, including the “ PROHIBITED ACTIVITIES ” section below, we grant you a non-exclusive, non-transferable, revocable license to:
- access the Services; and
- download or print a copy of any portion of the Content to which you have properly gained access,
solely for your personal, non-commercial use or internal business purpose.
Except as set out in this section or elsewhere in our Legal Terms, no part of the Services and no Content or Marks may be copied, reproduced, aggregated, republished, uploaded, posted, publicly displayed, encoded, translated, transmitted, distributed, sold, licensed, or otherwise exploited for any commercial purpose whatsoever, without our express prior written permission.
If you wish to make any use of the Services, Content, or Marks other than as set out in this section or elsewhere in our Legal Terms, please address your request to: info@wwh-soft.com . If we ever grant you the permission to post, reproduce, or publicly display any part of our Services or Content, you must identify us as the owners or licensors of the Services, Content, or Marks and ensure that any copyright or proprietary notice appears or is visible on posting, reproducing, or displaying our Content.
We reserve all rights not expressly granted to you in and to the Services, Content, and Marks.
Any breach of these Intellectual Property Rights will constitute a material breach of our Legal Terms and your right to use our Services will terminate immediately.
Your submissions
Please review this section and the “ PROHIBITED ACTIVITIES ” section carefully prior to using our Services to understand the (a) rights you give us and (b) obligations you have when you post or upload any content through the Services.
Submissions: By directly sending us any question, comment, suggestion, idea, feedback, or other information about the Services (“Submissions”), you agree to assign to us all intellectual property rights in such Submission. You agree that we shall own this Submission and be entitled to its unrestricted use and dissemination for any lawful purpose, commercial or otherwise, without acknowledgment or compensation to you.
You are responsible for what you post or upload: By sending us Submissions through any part of the Services you:
- confirm that you have read and agree with our “ PROHIBITED ACTIVITIES ” and will not post, send, publish, upload, or transmit through the Services any Submission that is illegal, harassing, hateful, harmful, defamatory, obscene, bullying, abusive, discriminatory, threatening to any person or group, sexually explicit, false, inaccurate, deceitful, or misleading;
- to the extent permissible by applicable law, waive any and all moral rights to any such Submission;
- warrant that any such Submission are original to you or that you have the necessary rights and licenses to submit such Submissions and that you have full authority to grant us the above-mentioned rights in relation to your Submissions; and
- warrant and represent that your Submissions do not constitute confidential information.
You are solely responsible for your Submissions and you expressly agree to reimburse us for any and all losses that we may suffer because of your breach of (a) this section, (b) any third party’s intellectual property rights, or (c) applicable law.
3. USER REPRESENTATIONS
By using the Services, you represent and warrant that: (1) you have the legal capacity and you agree to comply with these Legal Terms; (2) you are not a minor in the jurisdiction in which you reside; (3) you will not access the Services through automated or non-human means, whether through a bot, script or otherwise; (4) you will not use the Services for any illegal or unauthorized purpose; and (5) your use of the Services will not violate any applicable law or regulation.
If you provide any information that is untrue, inaccurate, not current, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Services (or any portion thereof).
4. PROHIBITED ACTIVITIES
You may not access or use the Services for any purpose other than that for which we make the Services available. The Services may not be used in connection with any commercial endeavors except those that are specifically endorsed or approved by us.
As a user of the Services, you agree not to:
- Systematically retrieve data or other content from the Services to create or compile, directly or indirectly, a collection, compilation, database, or directory without written permission from us.
- Trick, defraud, or mislead us and other users, especially in any attempt to learn sensitive account information such as user passwords.
- Circumvent, disable, or otherwise interfere with security-related features of the Services, including features that prevent or restrict the use or copying of any Content or enforce limitations on the use of the Services and/or the Content contained therein.
- Disparage, tarnish, or otherwise harm, in our opinion, us and/or the Services.
- Use any information obtained from the Services in order to harass, abuse, or harm another person.
- Make improper use of our support services or submit false reports of abuse or misconduct.
- Use the Services in a manner inconsistent with any applicable laws or regulations.
- Engage in unauthorized framing of or linking to the Services.
- Upload or transmit (or attempt to upload or to transmit) viruses, Trojan horses, or other material, including excessive use of capital letters and spamming (continuous posting of repetitive text), that interferes with any party’s uninterrupted use and enjoyment of the Services or modifies, impairs, disrupts, alters, or interferes with the use, features, functions, operation, or maintenance of the Services.
- Engage in any automated use of the system, such as using scripts to send comments or messages, or using any data mining, robots, or similar data gathering and extraction tools.
- Delete the copyright or other proprietary rights notice from any Content.
- Attempt to impersonate another user or person or use the username of another user.
- Upload or transmit (or attempt to upload or to transmit) any material that acts as a passive or active information collection or transmission mechanism, including without limitation, clear graphics interchange formats (“gifs”), 1×1 pixels, web bugs, cookies, or other similar devices (sometimes referred to as “spyware” or “passive collection mechanisms” or “pcms”).
- Interfere with, disrupt, or create an undue burden on the Services or the networks or services connected to the Services.
- Harass, annoy, intimidate, or threaten any of our employees or agents engaged in providing any portion of the Services to you.
- Attempt to bypass any measures of the Services designed to prevent or restrict access to the Services, or any portion of the Services.
- Copy or adapt the Services’ software, including but not limited to Flash, PHP, HTML, JavaScript, or other code.
- Except as permitted by applicable law, decipher, decompile, disassemble, or reverse engineer any of the software comprising or in any way making up a part of the Services.
- Except as may be the result of standard search engine or Internet browser usage, use, launch, develop, or distribute any automated system, including without limitation, any spider, robot, cheat utility, scraper, or offline reader that accesses the Services, or use or launch any unauthorized script or other software.
- Use a buying agent or purchasing agent to make purchases on the Services.
- Make any unauthorized use of the Services, including collecting usernames and/or email addresses of users by electronic or other means for the purpose of sending unsolicited email, or creating user accounts by automated means or under false pretenses.
- Use the Services as part of any effort to compete with us or otherwise use the Services and/or the Content for any revenue-generating endeavor or commercial enterprise.
5. USER GENERATED CONTRIBUTIONS
The Services does not offer users to submit or post content. We may provide you with the opportunity to create, submit, post, display, transmit, perform, publish, distribute, or broadcast content and materials to us or on the Services, including but not limited to text, writings, video, audio, photographs, graphics, comments, suggestions, or personal information or other material (collectively, “Contributions”). Contributions may be viewable by other users of the Services and through third-party websites.
6. CONTRIBUTION LICENSE
You and Services agree that we may access, store, process, and use any information and personal data that you provide and your choices (including settings).
By submitting suggestions or other feedback regarding the Services, you agree that we can use and share such feedback for any purpose without compensation to you.
We do not assert any ownership over your Contributions. You retain full ownership of all of your Contributions and any intellectual property rights or other proprietary rights associated with your Contributions. We are not liable for any statements or representations in your Contributions provided by you in any area on the Services. You are solely responsible for your Contributions to the Services and you expressly agree to exonerate us from any and all responsibility and to refrain from any legal action against us regarding your Contributions.
7. SERVICES MANAGEMENT
We reserve the right, but not the obligation, to: (1) monitor the Services for violations of these Legal Terms; (2) take appropriate legal action against anyone who, in our sole discretion, violates the law or these Legal Terms, including without limitation, reporting such user to law enforcement authorities; (3) in our sole discretion and without limitation, refuse, restrict access to, limit the availability of, or disable (to the extent technologically feasible) any of your Contributions or any portion thereof; (4) in our sole discretion and without limitation, notice, or liability, to remove from the Services or otherwise disable all files and content that are excessive in size or are in any way burdensome to our systems; and (5) otherwise manage the Services in a manner designed to protect our rights and property and to facilitate the proper functioning of the Services.
8. TERM AND TERMINATION
These Legal Terms shall remain in full force and effect while you use the Services. WITHOUT LIMITING ANY OTHER PROVISION OF THESE LEGAL TERMS, WE RESERVE THE RIGHT TO, IN OUR SOLE DISCRETION AND WITHOUT NOTICE OR LIABILITY, DENY ACCESS TO AND USE OF THE SERVICES (INCLUDING BLOCKING CERTAIN IP ADDRESSES), TO ANY PERSON FOR ANY REASON OR FOR NO REASON, INCLUDING WITHOUT LIMITATION FOR BREACH OF ANY REPRESENTATION, WARRANTY, OR COVENANT CONTAINED IN THESE LEGAL TERMS OR OF ANY APPLICABLE LAW OR REGULATION. WE MAY TERMINATE YOUR USE OR PARTICIPATION IN THE SERVICES OR DELETE ANY CONTENT OR INFORMATION THAT YOU POSTED AT ANY TIME, WITHOUT WARNING, IN OUR SOLE DISCRETION.
If we terminate or suspend your account for any reason, you are prohibited from registering and creating a new account under your name, a fake or borrowed name, or the name of any third party, even if you may be acting on behalf of the third party. In addition to terminating or suspending your account, we reserve the right to take appropriate legal action, including without limitation pursuing civil, criminal, and injunctive redress.
9. MODIFICATIONS AND INTERRUPTIONS
We reserve the right to change, modify, or remove the contents of the Services at any time or for any reason at our sole discretion without notice. However, we have no obligation to update any information on our Services. We will not be liable to you or any third party for any modification, price change, suspension, or discontinuance of the Services.
We cannot guarantee the Services will be available at all times. We may experience hardware, software, or other problems or need to perform maintenance related to the Services, resulting in interruptions, delays, or errors. We reserve the right to change, revise, update, suspend, discontinue, or otherwise modify the Services at any time or for any reason without notice to you. You agree that we have no liability whatsoever for any loss, damage, or inconvenience caused by your inability to access or use the Services during any downtime or discontinuance of the Services. Nothing in these Legal Terms will be construed to obligate us to maintain and support the Services or to supply any corrections, updates, or releases in connection therewith.
10. GOVERNING LAW
These Legal Terms shall be governed by and defined following the laws of Düsseldorf, Germany. Weichwerke Heidrich Software and yourself irrevocably consent that the courts of Düsseldorf, Germany shall have exclusive jurisdiction to resolve any dispute which may arise in connection with these Legal Terms.
11. DISPUTE RESOLUTION
Informal Negotiations
To expedite resolution and control the cost of any dispute, controversy, or claim related to these Legal Terms (each a “Dispute” and collectively, the “Disputes”) brought by either you or us (individually, a “Party” and collectively, the “Parties”), the Parties agree to first attempt to negotiate any Dispute (except those Disputes expressly provided below) informally for at least 30 days before initiating arbitration. Such informal negotiations commence upon written notice from one Party to the other Party.
Binding Arbitration
Any dispute arising out of or in connection with these Legal Terms, including any question regarding its existence, validity, or termination, shall be referred to and finally resolved by the International Commercial Arbitration Court under the European Arbitration Chamber (Belgium, Brussels, Avenue Louise, 146) according to the Rules of this ICAC, which, as a result of referring to it, is considered as the part of this clause. The number of arbitrators shall be 2. The seat, or legal place, or arbitration shall be Düsseldorf, Germany. The language of the proceedings shall be English. The governing law of these Legal Terms shall be substantive law of Düsseldorf, Germany.
Restrictions
The Parties agree that any arbitration shall be limited to the Dispute between the Parties individually. To the full extent permitted by law, (a) no arbitration shall be joined with any other proceeding; (b) there is no right or authority for any Dispute to be arbitrated on a class-action basis or to utilize class action procedures; and (c) there is no right or authority for any Dispute to be brought in a purported representative capacity on behalf of the general public or any other persons.
Exceptions to Informal Negotiations and Arbitration
The Parties agree that the following Disputes are not subject to the above provisions concerning informal negotiations binding arbitration: (a) any Disputes seeking to enforce or protect, or concerning the validity of, any of the intellectual property rights of a Party; (b) any Dispute related to, or arising from, allegations of theft, piracy, invasion of privacy, or unauthorized use; and (c) any claim for injunctive relief. If this provision is found to be illegal or unenforceable, then neither Party will elect to arbitrate any Dispute falling within that portion of this provision found to be illegal or unenforceable and such Dispute shall be decided by a court of competent jurisdiction within the courts listed for jurisdiction above, and the Parties agree to submit to the personal jurisdiction of that court.
12. CORRECTIONS
There may be information on the Services that contains typographical errors, inaccuracies, or omissions, including descriptions, pricing, availability, and various other information. We reserve the right to correct any errors, inaccuracies, or omissions and to change or update the information on the Services at any time, without prior notice.
13. DISCLAIMER
THE SERVICES ARE PROVIDED ON AN AS-IS AND AS-AVAILABLE BASIS. YOU AGREE THAT YOUR USE OF THE SERVICES WILL BE AT YOUR SOLE RISK. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, IN CONNECTION WITH THE SERVICES AND YOUR USE THEREOF, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE MAKE NO WARRANTIES OR REPRESENTATIONS ABOUT THE ACCURACY OR COMPLETENESS OF THE SERVICES’ CONTENT OR THE CONTENT OF ANY WEBSITES OR MOBILE APPLICATIONS LINKED TO THE SERVICES AND WE WILL ASSUME NO LIABILITY OR RESPONSIBILITY FOR ANY (1) ERRORS, MISTAKES, OR INACCURACIES OF CONTENT AND MATERIALS, (2) PERSONAL INJURY OR PROPERTY DAMAGE, OF ANY NATURE WHATSOEVER, RESULTING FROM YOUR ACCESS TO AND USE OF THE SERVICES, (3) ANY UNAUTHORIZED ACCESS TO OR USE OF OUR SECURE SERVERS AND/OR ANY AND ALL PERSONAL INFORMATION AND/OR FINANCIAL INFORMATION STORED THEREIN, (4) ANY INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM THE SERVICES, (5) ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE WHICH MAY BE TRANSMITTED TO OR THROUGH THE SERVICES BY ANY THIRD PARTY, AND/OR (6) ANY ERRORS OR OMISSIONS IN ANY CONTENT AND MATERIALS OR FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OF THE USE OF ANY CONTENT POSTED, TRANSMITTED, OR OTHERWISE MADE AVAILABLE VIA THE SERVICES. WE DO NOT WARRANT, ENDORSE, GUARANTEE, OR ASSUME RESPONSIBILITY FOR ANY PRODUCT OR SERVICE ADVERTISED OR OFFERED BY A THIRD PARTY THROUGH THE SERVICES, ANY HYPERLINKED WEBSITE, OR ANY WEBSITE OR MOBILE APPLICATION FEATURED IN ANY BANNER OR OTHER ADVERTISING, AND WE WILL NOT BE A PARTY TO OR IN ANY WAY BE RESPONSIBLE FOR MONITORING ANY TRANSACTION BETWEEN YOU AND ANY THIRD-PARTY PROVIDERS OF PRODUCTS OR SERVICES. AS WITH THE PURCHASE OF A PRODUCT OR SERVICE THROUGH ANY MEDIUM OR IN ANY ENVIRONMENT, YOU SHOULD USE YOUR BEST JUDGMENT AND EXERCISE CAUTION WHERE APPROPRIATE.
14. LIMITATIONS OF LIABILITY
IN NO EVENT WILL WE OR OUR DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFIT, LOST REVENUE, LOSS OF DATA, OR OTHER DAMAGES ARISING FROM YOUR USE OF THE SERVICES, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED HEREIN, OUR LIABILITY TO YOU FOR ANY CAUSE WHATSOEVER AND REGARDLESS OF THE FORM OF THE ACTION, WILL AT ALL TIMES BE LIMITED TO THE LESSER OF THE AMOUNT PAID, IF ANY, BY YOU TO US. CERTAIN US STATE LAWS AND INTERNATIONAL LAWS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES OR THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES. IF THESE LAWS APPLY TO YOU, SOME OR ALL OF THE ABOVE DISCLAIMERS OR LIMITATIONS MAY NOT APPLY TO YOU, AND YOU MAY HAVE ADDITIONAL RIGHTS.
15. INDEMNIFICATION
You agree to defend, indemnify, and hold us harmless, including our subsidiaries, affiliates, and all of our respective officers, agents, partners, and employees, from and against any loss, damage, liability, claim, or demand, including reasonable attorneys’ fees and expenses, made by any third party due to or arising out of: (1) use of the Services; (2) breach of these Legal Terms; (3) any breach of your representations and warranties set forth in these Legal Terms; (4) your violation of the rights of a third party, including but not limited to intellectual property rights; or (5) any overt harmful act toward any other user of the Services with whom you connected via the Services. Notwithstanding the foregoing, we reserve the right, at your expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us, and you agree to cooperate, at your expense, with our defense of such claims. We will use reasonable efforts to notify you of any such claim, action, or proceeding which is subject to this indemnification upon becoming aware of it.
16. USER DATA
We will maintain certain data that you transmit to the Services for the purpose of managing the performance of the Services, as well as data relating to your use of the Services. Although we perform regular routine backups of data, you are solely responsible for all data that you transmit or that relates to any activity you have undertaken using the Services. You agree that we shall have no liability to you for any loss or corruption of any such data, and you hereby waive any right of action against us arising from any such loss or corruption of such data.
17. ELECTRONIC COMMUNICATIONS, TRANSACTIONS, AND SIGNATURES
Visiting the Services, sending us emails, and completing online forms constitute electronic communications. You consent to receive electronic communications, and you agree that all agreements, notices, disclosures, and other communications we provide to you electronically, via email and on the Services, satisfy any legal requirement that such communication be in writing. YOU HEREBY AGREE TO THE USE OF ELECTRONIC SIGNATURES, CONTRACTS, ORDERS, AND OTHER RECORDS, AND TO ELECTRONIC DELIVERY OF NOTICES, POLICIES, AND RECORDS OF TRANSACTIONS INITIATED OR COMPLETED BY US OR VIA THE SERVICES. You hereby waive any rights or requirements under any statutes, regulations, rules, ordinances, or other laws in any jurisdiction which require an original signature or delivery or retention of non-electronic records, or to payments or the granting of credits by any means other than electronic means.
18. FREE ACCESS TO BOMNIPOTENT FOR NON-COMMERCIAL ENTITIES
Eligibility
Free access to the Application is available to entities meeting the following criteria:
- Non-Commercial Use: The Application must be used exclusively for non-commercial purposes, including but not limited to education, research, personal projects, or charitable activities.
- Non-Profit Status: Organisations must demonstrate non-profit status or equivalent, as defined under the laws of their jurisdiction. Examples include registered charities, academic institutions, and research organisations.
- Transparency: Individuals or organisations must provide clear evidence of non-commercial activities, such as links to relevant websites, repositories, or publications.
- Exclusions:
- Organisations with commercial revenue streams, even if partially supporting non-commercial projects, are not eligible for free access.
- Government agencies, political organisations, and other entities with mixed commercial/non-commercial missions must apply for paid access.
Application Process
- Submission: To request free access, you must send an email to info@wwh-soft.com , including a link to relevant websites, repositories, or publications.
- Review Period: Applications will be reviewed within 20 business days. We may request additional information to verify eligibility.
- Approval or Denial: Decisions are made at our sole discretion. If denied, applicants may reapply after addressing feedback or when circumstances change.
Permitted Scope of Use
The Application must only be used for the purposes outlined in your application and must not:
- Be sold, resold, or used in commercial services.
- Be integrated into proprietary software or systems for commercial gain.
Revocation of Access
We reserve the right to revoke free access at any time if we determine:
- Misrepresentation of non-commercial status.
- Violation of permitted usage guidelines.
- Other breaches of these Terms.
In case of revocation, you will be notified via the email address provided during application.
19. MISCELLANEOUS
These Legal Terms and any policies or operating rules posted by us on the Services or in respect to the Services constitute the entire agreement and understanding between you and us. Our failure to exercise or enforce any right or provision of these Legal Terms shall not operate as a waiver of such right or provision. These Legal Terms operate to the fullest extent permissible by law. We may assign any or all of our rights and obligations to others at any time. We shall not be responsible or liable for any loss, damage, delay, or failure to act caused by any cause beyond our reasonable control. If any provision or part of a provision of these Legal Terms is determined to be unlawful, void, or unenforceable, that provision or part of the provision is deemed severable from these Legal Terms and does not affect the validity and enforceability of any remaining provisions. There is no joint venture, partnership, employment or agency relationship created between you and us as a result of these Legal Terms or use of the Services. You agree that these Legal Terms will not be construed against us by virtue of having drafted them. You hereby waive any and all defenses you may have based on the electronic form of these Legal Terms and the lack of signing by the parties hereto to execute these Legal Terms.
20. CONTACT US
In order to resolve a complaint regarding the Services or to receive further information regarding use of the Services, please contact us by email at info@wwh-soft.com or by mail to Weichwerke Heidrich Software, Im Hirschmorgen 32, 69181 Leimen, Germany.
VAT ID no: DE450755905
Imprint
Weichwerke Heidrich Software
Im Hirschmorgen 32
DE-69181 Leimen
Mail info@wwh-soft.com
Website: https://www.wwh-soft.com
Authorised representative: Simon Heidrich
VAT ID no: DE450755905
Founding Date: 02.12.2024