mirror of
https://github.com/MariaDB/server.git
synced 2025-10-31 02:46:29 +01:00
2563839853
This commit adds the capability to generate a Software Bill of Materials (SBOM) from server builds. It introduces a new WITH_SBOM variable, which defaults to ON for package builds (i.e if BUILD_CONFIG is used) and to OFF otherwise. When enabled, the build process will produce an sbom.json document in CycloneDX format, capturing information about various dependencies, which is gathered from various sources. We use git submodule information and CMake external projects properties to gather version information for 3rd party code, but also handle dependencies if external code is part of our repository (zlib, or Connect storage engine's minizip) The SBOM document is stored in the root build directory in sbom.json file, but is not currently installed.
45 lines
1 KiB
JSON
45 lines
1 KiB
JSON
{
|
|
"serialNumber": "urn:uuid:@UUID@",
|
|
"version": 1,
|
|
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
|
|
"bomFormat": "CycloneDX",
|
|
"specVersion": "1.6",
|
|
"metadata": {
|
|
"lifecycles": [
|
|
{"phase": "build"}
|
|
],
|
|
"component": {
|
|
"bom-ref": "@CPACK_PACKAGE_NAME@",
|
|
"type": "application",
|
|
"name": "@CPACK_PACKAGE_NAME@",
|
|
"version": "@CPACK_PACKAGE_VERSION@",
|
|
"supplier": {
|
|
"name": "@CPACK_PACKAGE_VENDOR@",
|
|
"url": [
|
|
"@CPACK_PACKAGE_URL@"
|
|
]
|
|
},
|
|
"purl": "pkg:github/@GITHUB_REPO_USER@/@GITHUB_REPO_NAME@@@GIT_REV_SHORT@",
|
|
"cpe": "cpe:2.3:a:mariadb:mariadb:@CPACK_PACKAGE_VERSION@:*:*:*:*:*:*"
|
|
},
|
|
"authors": [
|
|
{
|
|
"email": "info@mariadb.com",
|
|
"name": "MariaDB"
|
|
}
|
|
],
|
|
"properties": [
|
|
{
|
|
"name": "package_name",
|
|
"value": "@CPACK_PACKAGE_FILE_NAME@"
|
|
}
|
|
],
|
|
"timestamp": "@TIMESTAMP@"
|
|
},
|
|
"components": [
|
|
@sbom_components@
|
|
],
|
|
"dependencies": [
|
|
@sbom_dependencies@
|
|
]
|
|
}
|