Class: GemGuard::SbomGenerator

Inherits:
Object
  • Object
show all
Defined in:
lib/gem_guard/sbom_generator.rb

Constant Summary collapse

SPDX_VERSION = 
"SPDX-2.3"
CYCLONE_DX_VERSION = 
"1.5"

Instance Method Summary collapse

Constructor Details

#initialize ⇒ SbomGenerator

Returns a new instance of SbomGenerator.



10
11
12
13
 
# File 'lib/gem_guard/sbom_generator.rb', line 10

def initialize
  @document_id = "SPDXRef-DOCUMENT"
  @creation_time = Time.now.utc.iso8601
end

Instance Method Details

#generate_cyclone_dx(dependencies, project_name = "ruby-project") ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/gem_guard/sbom_generator.rb', line 32

def generate_cyclone_dx(dependencies, project_name = "ruby-project")
  {
    "bomFormat" => "CycloneDX",
    "specVersion" => CYCLONE_DX_VERSION,
    "serialNumber" => "urn:uuid:#{generate_uuid}",
    "version" => 1,
    "metadata" => {
      "timestamp" => @creation_time,
      "tools" => [
        {
          "vendor" => "GemGuard",
          "name" => "gem_guard",
          "version" => GemGuard::VERSION
        }
      ],
      "component" => {
        "type" => "application",
        "name" => project_name,
        "version" => "1.0.0"
      }
    },
    "components" => build_cyclone_dx_components(dependencies)
  }
end

#generate_spdx(dependencies, project_name = "ruby-project") ⇒ Object 



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/gem_guard/sbom_generator.rb', line 15

def generate_spdx(dependencies, project_name = "ruby-project")
  {
    "spdxVersion" => SPDX_VERSION,
    "dataLicense" => "CC0-1.0",
    "SPDXID" => @document_id,
    "name" => "#{project_name}-sbom",
    "documentNamespace" => "https://gem-guard.dev/#{project_name}/#{@creation_time}",
    "creationInfo" => {
      "created" => @creation_time,
      "creators" => ["Tool: gem_guard-#{GemGuard::VERSION}"],
      "licenseListVersion" => "3.21"
    },
    "packages" => build_spdx_packages(dependencies, project_name),
    "relationships" => build_spdx_relationships(dependencies)
  }
end