100 lines
2.8 KiB
Go
100 lines
2.8 KiB
Go
// Package sbom generates Software Bills of Materials in CycloneDX 1.4 JSON format.
|
|
// https://cyclonedx.org/specification/overview/
|
|
package sbom
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
FormatCycloneDX = "cyclonedx-json-1.4"
|
|
SpecVersion = "1.4"
|
|
BOMFormat = "CycloneDX"
|
|
)
|
|
|
|
// Document is the top-level CycloneDX 1.4 BOM.
|
|
type Document struct {
|
|
BOMFormat string `json:"bomFormat"`
|
|
SpecVersion string `json:"specVersion"`
|
|
SerialNumber string `json:"serialNumber"`
|
|
Version int `json:"version"`
|
|
Metadata Metadata `json:"metadata"`
|
|
Components []Component `json:"components"`
|
|
}
|
|
|
|
type Metadata struct {
|
|
Timestamp string `json:"timestamp"`
|
|
Tools []Tool `json:"tools"`
|
|
Component *Component `json:"component,omitempty"`
|
|
}
|
|
|
|
type Tool struct {
|
|
Vendor string `json:"vendor"`
|
|
Name string `json:"name"`
|
|
Version string `json:"version"`
|
|
}
|
|
|
|
// Component represents a software dependency in the BOM.
|
|
type Component struct {
|
|
Type string `json:"type"` // "library", "application", "framework"
|
|
Name string `json:"name"`
|
|
Version string `json:"version,omitempty"`
|
|
PURL string `json:"purl,omitempty"`
|
|
Description string `json:"description,omitempty"`
|
|
Scope string `json:"scope,omitempty"` // "required", "optional"
|
|
ExternalRefs []ExternalRef `json:"externalReferences,omitempty"`
|
|
}
|
|
|
|
type ExternalRef struct {
|
|
Type string `json:"type"` // "website", "vcs", "distribution"
|
|
URL string `json:"url"`
|
|
}
|
|
|
|
// NewDocument creates a blank CycloneDX 1.4 document with metadata populated.
|
|
func NewDocument(repoName, sha string) *Document {
|
|
return &Document{
|
|
BOMFormat: BOMFormat,
|
|
SpecVersion: SpecVersion,
|
|
SerialNumber: fmt.Sprintf("urn:uuid:forgebucket:%s:%s", repoName, sha[:7]),
|
|
Version: 1,
|
|
Metadata: Metadata{
|
|
Timestamp: time.Now().UTC().Format(time.RFC3339),
|
|
Tools: []Tool{
|
|
{Vendor: "ForgeBucket", Name: "sbom-generator", Version: "1.0.0"},
|
|
},
|
|
Component: &Component{
|
|
Type: "application",
|
|
Name: repoName,
|
|
},
|
|
},
|
|
Components: []Component{},
|
|
}
|
|
}
|
|
|
|
// PURL helpers — produce Package URL strings per ecosystem.
|
|
|
|
func golangPURL(module, version string) string {
|
|
return fmt.Sprintf("pkg:golang/%s@%s", module, version)
|
|
}
|
|
|
|
func npmPURL(name, version string) string {
|
|
return fmt.Sprintf("pkg:npm/%s@%s", name, version)
|
|
}
|
|
|
|
func pypiPURL(name, version string) string {
|
|
return fmt.Sprintf("pkg:pypi/%s@%s", name, version)
|
|
}
|
|
|
|
func cargoPURL(name, version string) string {
|
|
return fmt.Sprintf("pkg:cargo/%s@%s", name, version)
|
|
}
|
|
|
|
func gemPURL(name, version string) string {
|
|
return fmt.Sprintf("pkg:gem/%s@%s", name, version)
|
|
}
|
|
|
|
func mavenPURL(group, artifact, version string) string {
|
|
return fmt.Sprintf("pkg:maven/%s/%s@%s", group, artifact, version)
|
|
}
|