Skip to content

Commit 2cbb8bf

Browse files
vector-of-boolvector-of-bool
authored
[CDRIVER-5535] Add files and an Earthly target for an SBOM-lite (#1594)
Add files and an Earthly target for an SBOM-lite via SilkBomb
1 parent 1d642e4 commit 2cbb8bf

File tree

3 files changed

+172
-0
lines changed

3 files changed

+172
-0
lines changed

‎Earthfile

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,26 @@ multibuild:
171171
--c_compiler=gcc --c_compiler=clang \
172172
--test_mongocxx_ref=master
173173

174+
# sbom-generate :
175+
# Generate/update the etc/cyclonedx.sbom.json file from the etc/purls.txt file.
176+
#
177+
# This target will update the existing etc/cyclonedx.sbom.json file in-place based
178+
# on the content of etc/purls.txt.
179+
sbom-generate:
180+
FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0
181+
# Alias the silkbom executable to a simpler name:
182+
RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
183+
# Copy in the relevant files:
184+
WORKDIR /s
185+
COPY etc/purls.txt etc/cyclonedx.sbom.json /s/
186+
# Update the SBOM file:
187+
RUN silkbomb update \
188+
--purls purls.txt \
189+
--sbom-in cyclonedx.sbom.json \
190+
--sbom-out cyclonedx.sbom.json
191+
# Save the result back to the host:
192+
SAVE ARTIFACT /s/cyclonedx.sbom.json AS LOCAL etc/cyclonedx.sbom.json
193+
174194
# test-vcpkg-classic :
175195
# Builds src/libmongoc/examples/cmake/vcpkg by using vcpkg to download and
176196
# install a mongo-c-driver build in "classic mode". *Does not* use the local

‎etc/cyclonedx.sbom.json

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
{
2+
"components": [
3+
{
4+
"bom-ref": "pkg:github/juliastrings/[email protected]",
5+
"externalReferences": [
6+
{
7+
"type": "distribution",
8+
"url": "https://github.com/juliastrings/utf8proc/archive/refs/tags/2.8.0.tar.gz"
9+
},
10+
{
11+
"type": "website",
12+
"url": "https://github.com/juliastrings/utf8proc/tree/2.8.0"
13+
}
14+
],
15+
"group": "juliastrings",
16+
"name": "utf8proc",
17+
"purl": "pkg:github/juliastrings/[email protected]",
18+
"type": "library",
19+
"version": "2.8.0"
20+
},
21+
{
22+
"bom-ref": "pkg:github/madler/[email protected]",
23+
"externalReferences": [
24+
{
25+
"type": "distribution",
26+
"url": "https://github.com/madler/zlib/archive/refs/tags/v1.2.13.tar.gz"
27+
},
28+
{
29+
"type": "website",
30+
"url": "https://github.com/madler/zlib/tree/v1.2.13"
31+
}
32+
],
33+
"group": "madler",
34+
"name": "zlib",
35+
"purl": "pkg:github/madler/[email protected]",
36+
"type": "library",
37+
"version": "v1.2.13"
38+
},
39+
{
40+
"bom-ref": "pkg:github/mnunberg/jsonsl",
41+
"externalReferences": [
42+
{
43+
"type": "website",
44+
"url": "https://github.com/mnunberg/jsonsl"
45+
}
46+
],
47+
"group": "mnunberg",
48+
"name": "jsonsl",
49+
"purl": "pkg:github/mnunberg/jsonsl",
50+
"type": "library"
51+
},
52+
{
53+
"bom-ref": "pkg:github/troydhanson/[email protected]",
54+
"externalReferences": [
55+
{
56+
"type": "distribution",
57+
"url": "https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz"
58+
},
59+
{
60+
"type": "website",
61+
"url": "https://github.com/troydhanson/uthash/tree/v2.3.0"
62+
}
63+
],
64+
"group": "troydhanson",
65+
"name": "uthash",
66+
"purl": "pkg:github/troydhanson/[email protected]",
67+
"type": "library",
68+
"version": "v2.3.0"
69+
}
70+
],
71+
"dependencies": [
72+
{
73+
"ref": "pkg:github/juliastrings/[email protected]"
74+
},
75+
{
76+
"ref": "pkg:github/madler/[email protected]"
77+
},
78+
{
79+
"ref": "pkg:github/mnunberg/jsonsl"
80+
},
81+
{
82+
"ref": "pkg:github/troydhanson/[email protected]"
83+
}
84+
],
85+
"metadata": {
86+
"timestamp": "2024-05-03T19:02:40.015183+00:00",
87+
"tools": [
88+
{
89+
"externalReferences": [
90+
{
91+
"type": "build-system",
92+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
93+
},
94+
{
95+
"type": "distribution",
96+
"url": "https://pypi.org/project/cyclonedx-python-lib/"
97+
},
98+
{
99+
"type": "documentation",
100+
"url": "https://cyclonedx-python-library.readthedocs.io/"
101+
},
102+
{
103+
"type": "issue-tracker",
104+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
105+
},
106+
{
107+
"type": "license",
108+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
109+
},
110+
{
111+
"type": "release-notes",
112+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
113+
},
114+
{
115+
"type": "vcs",
116+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib"
117+
},
118+
{
119+
"type": "website",
120+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
121+
}
122+
],
123+
"name": "cyclonedx-python-lib",
124+
"vendor": "CycloneDX",
125+
"version": "6.4.4"
126+
}
127+
]
128+
},
129+
"serialNumber": "urn:uuid:e5a75bd1-68a4-499e-81c6-64a8785adaae",
130+
"version": 1,
131+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
132+
"bomFormat": "CycloneDX",
133+
"specVersion": "1.5"
134+
}

‎etc/purls.txt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# These package URLs (purls) point to the versions (tags) of external dependencies
2+
# that are committed to the project. Refer: https://github.com/package-url/purl-spec
3+
4+
# This file is fed to silkbomb to generate the cyclonedx.sbom.json file. Edit this file
5+
# instead of modifying the SBOM JSON directly. After modifying this file, be sure to
6+
# re-generate the SBOM JSON file!
7+
8+
# Lives at src/zlib-*
9+
pkg:github/madler/[email protected]
10+
11+
# Lives at src/utf8proc-*
12+
pkg:github/JuliaStrings/[email protected]
13+
14+
# Lives at src/uthash
15+
pkg:github/troydhanson/[email protected]
16+
17+
# Lives at src/libbson/src/jsonsl
18+
pkg:github/mnunberg/jsonsl

0 commit comments

Comments
 (0)