sbom

README

sbom

Pure-Go software bill of materials emitter for built pkgx bottles and their dependency closures. Emits SPDX 2.3 JSON and CycloneDX 1.5 JSON with zero runtime dependencies — hand-rolled structs plus encoding/json only. Conformance is proven in test-only code by decoding the output with the reference libraries (spdx/tools-golang and CycloneDX/cyclonedx-go).

Usage

import "github.com/go-attest/sbom"

d := sbom.Document{
    Name:    "openssl.org",
    Version: "1.1.1w",
    PURL:    "pkg:pkgx/openssl.org@1.1.1w",
    License: "Apache-2.0",
    SHA256:  "…", // lowercase-hex bottle digest
    Created: buildTime,
    Components: []sbom.Component{
        {Name: "ca-certs", Version: "2024.7.2", License: "MPL-2.0"},
    },
}

spdxJSON, _ := d.SPDX()      // indented SPDX 2.3 JSON
cdxJSON, _ := d.CycloneDX()  // indented CycloneDX 1.5 JSON

Output is deterministic: the same Document always yields byte-identical bytes. All optional fields (PURL, License, SHA256) are omitted from the output when empty; SPDX license fields fall back to NOASSERTION.

CLI

$ go run github.com/go-attest/sbom/cmd/sbom \
    --format cyclonedx --name openssl.org --version 1.1.1w

Flags: --format spdx|cyclonedx (default spdx), --name, --version (both required), and optional --purl, --license, --sha256.

License

BSD-3-Clause © the sbom authors

Documentation

Overview

Package sbom emits SPDX 2.3 JSON and CycloneDX 1.5 JSON software bills of materials for a built pkgx bottle plus its dependency closure.

The package has zero runtime dependencies: documents are built from hand-rolled structs and serialized with encoding/json only.

Index

• type Component
• type Document
  • func (d Document) CycloneDX() ([]byte, error)
  • func (d Document) SPDX() ([]byte, error)

Types

type Component

type Component struct {
	Name    string
	Version string
	PURL    string // package URL, e.g. "pkg:pkgx/openssl.org@1.1.1w"; optional
	License string // SPDX license expression/id, e.g. "Apache-2.0"; optional
	SHA256  string // lowercase-hex SHA-256 of the component's bottle tarball; optional
}

Component is one package in the bill of materials (a dependency).

type Document

type Document struct {
	Name       string      // subject package, e.g. "openssl.org"
	Version    string      // e.g. "1.1.1w"
	PURL       string      // subject package URL; optional
	License    string      // subject license; optional
	SHA256     string      // subject bottle digest; optional
	Namespace  string      // stable document identity URI (SPDX documentNamespace)
	Created    time.Time   // build timestamp (rendered as RFC 3339 UTC)
	Components []Component // dependency closure
}

Document is a bill of materials whose subject is one built bottle.

func (Document) CycloneDX

func (d Document) CycloneDX() ([]byte, error)

CycloneDX renders the document as indented CycloneDX 1.5 JSON.

func (Document) SPDX

func (d Document) SPDX() ([]byte, error)

SPDX renders the document as indented SPDX 2.3 JSON.