Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for more spdx fields #26

Merged
merged 7 commits into from
Sep 11, 2024
Merged

Add support for more spdx fields #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
81489cc
feat: adding support for most package fields
Avus-c Sep 2, 2024
b189cc9
docs: some comments to clarify
Avus-c Sep 5, 2024
1b90ae9
feat: add final set of missing SPDX fields to generate call
Avus-c Sep 6, 2024
c0f625f
feat: add missing fields to add_package function
Avus-c Sep 9, 2024
48c3f90
feat: add missing fields to sbom_add_file function
Avus-c Sep 9, 2024
ee94fdc
docs: added an example to how-to-use
Avus-c Sep 10, 2024
c436408
refactor: user has to provide a creator to comply
Avus-c Sep 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
808 changes: 555 additions & 253 deletions cmake/sbom.cmake
View file
Open in desktop

Large diffs are not rendered by default.

13 changes: 8 additions & 5 deletions example/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,17 +34,20 @@ include(../cmake/sbom.cmake)
# This is the only required call to generate the SBOM. It has to be called before any other
# sbom_add_* function.
sbom_generate(
LICENSE CC0-1.0
SUPPLIER ${PROJECT_NAME}
SUPPLIER_URL ${PROJECT_HOMEPAGE_URL}
CREATOR ORGANIZATION "Example Org" EMAIL "[email protected]"
PACKAGE_URL ${PROJECT_HOMEPAGE_URL}
PACKAGE_DOWNLOAD "http://example.org/download"
PACKAGE_LICENSE "MIT"
PACKAGE_NOTES SUMMARY "Just a simple example project, to demonstrate the SBOM-Builder"
PACKAGE_PURPOSE "APPLICATION" "OTHER"
)

# mention the dependencies used in the SBOM
CPMAddPackage( "gh:jarro2783/[email protected]" )
sbom_add_package(
cxxopts
VERSION 3.2.0
SUPPLIER "Jarryd Beck (https://github.com/jarro2783/cxxopts)"
SUPPLIER PERSON "Jarryd Beck"
LICENSE MIT
)

Expand All @@ -58,7 +61,7 @@ CPMAddPackage(
sbom_add_package(
Boost
VERSION "1.85.0"
SUPPLIER "https://www.boost.org"
SUPPLIER ORGANIZATION "Boost Foundation"
LICENSE BSL-1.0
)

Expand Down
24 changes: 13 additions & 11 deletions example/output/Example-sbom-0.3.0.spdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: Example-sbom-v0.3.0-13-gd5b28ae+comprehensive-example+dirty.spdx
DocumentNamespace: https://github.com/sodgeit/CMake-SBOM-Builder/spdxdocs/Example-v0.3.0-13-gd5b28ae+comprehensive-example+dirty
Creator: Organization: Example
Creator: Tool: CMake-SBOM-Builder-0.0.0-development-version
DocumentName: Example-sbom-v0.3.0
DocumentNamespace: https://github.com/sodgeit/CMake-SBOM-Builder/spdxdocs/Example-v0.3.0
Creator: Organization: Example Org ([email protected])
Creator: Tool: CMake-SBOM-Builder-v0.3.0
CreatorComment: <text>This SPDX document was created from CMake 3.30.1, using CMake-SBOM-Builder from https://github.com/sodgeit/CMake-SBOM-Builder</text>
Created: 2024-08-29T09:16:55Z

Expand All @@ -26,14 +26,16 @@ RelationshipComment: <text>SPDXRef-Example is built by compiler Clang (C:/Progra
PackageName: Example
SPDXID: SPDXRef-Example
ExternalRef: SECURITY cpe23Type cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*
ExternalRef: PACKAGE-MANAGER purl pkg:supplier/Example/[email protected]+comprehensive-example+dirty
PackageVersion: v0.3.0-13-gd5b28ae+comprehensive-example+dirty
PackageSupplier: Organization: Example
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: CC0-1.0
PackageLicenseDeclared: CC0-1.0
PackageCopyrightText: 2024;Example
ExternalRef: PACKAGE-MANAGER purl pkg:supplier/Example/[email protected]
PackageVersion: v0.3.0
PackageFileName: Example-v0.3.0.zip
PackageSupplier: Organization: Example Org ([email protected])
PackageDownloadLocation: http://example.org/download
PackageLicenseConcluded: MIT
PackageLicenseDeclared: MIT
PackageCopyrightText: 2024 Example Org
PackageHomePage: https://github.com/sodgeit/CMake-SBOM-Builder
PackageSummary: <text>Just a simple example project, to demonstrate the SBOM-Builder</text>
PackageComment: <text>Built by CMake 3.30.1 with Release configuration for Windows (AMD64)</text>
PackageVerificationCode: eab840722ebab9379e046b88ce0e6f6f616a2eb6
BuiltDate: 2024-08-29T09:16:55Z
Expand Down
Loading
Loading