tutorial missing

[AnaisUrlichs]

Hi all, could I add a tutorial on how to use this tool -- just a simple tutorial.md file? Wanted to ask before putting the work in :)

[justinabrahms]

That would be super wonderful. :D

[rnjudge]

+1 on a tutorial, please :) It's not clear how to run the tool for new users.

[jspeed-meyers]

I'm glad to pitch in too!

[jspeed-meyers]

@AnaisUrlichs, @rnjudge, @justinabrahms

I put in PR #18 to add a first draft of a tutorial. Feel free to fork it, improve it, change it, etc. But I thought this would help to get the ball rolling :)

Also, if you try it and it doesn't work on your machine or it's unclear, all the better! I'm glad to make improvements and fix errors.

[justinabrahms]

Thanks, @jspeed-meyers. Closing this out. Folks can find the tutorial at https://github.com/eBay/sbom-scorecard/blob/main/tutorial.md

[rnjudge]

@jspeed-meyers this is definitely a "me" problem because I am fairly new to go.. but I tried to follow your tutorial and can't seem to get the sbom-scorecard command to work... any tips? I imagine non go programmers might run into the same issue.

Here's my go environment:

rose@rose-vm:~/ternenv/sbom-scorecard$ go env
GOMODCACHE="/home/rose/go/pkg/mod"
GOPATH="/home/rose/go"
GOROOT="/usr/local/go"
rose@rose-vm:~/ternenv/sbom-scorecard$ go version
go version go1.19.4 linux/arm64

When I follow your tutorial to build the package, I don't see a bin directory created in my $GOPATH, which the tutorial assumes is in my path:

rose@rose-vm:~/ternenv/sbom-scorecard$ go build cmd/sbom-scorecard/main.go
go: downloading github.com/spf13/cobra v1.6.1
go: downloading github.com/spdx/tools-golang v0.3.1-0.20221003161519-fb7fe8874d01
go: downloading github.com/CycloneDX/cyclonedx-go v0.7.0
go: downloading github.com/spf13/pflag v1.0.5
rose@rose-vm:~/ternenv/sbom-scorecard$ ls $GOPATH
pkg
rose@rose-vm:~/ternenv/sbom-scorecard$ sbom-scorecard
sbom-scorecard: command not found

[jspeed-meyers]

@rnjudge, I put in PR #20, which might help. Just using go build does not place the executable in the bin folder. go install does place the executable in the bin folder. That tutorial had a bug in it. Sorry!!

This SO post might help conceptually: https://stackoverflow.com/a/54429573

Also, I'm learning Go myself, so apologies for having bugs in the tutorial. Hopefully this helps. If not, ping again and I'll keep debugging :)