bundler-sbom 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb32eb6e21ec3b09fe1d3d199b978c44313f119ee57bb9d3899b20ae443020c0
-  data.tar.gz: 36b4b1b637fbafa93ac463418e5e26330146cff96b7c2e76733bc7c5b4a2cfc9
+  metadata.gz: d5d7fea7d39796fd36fec03e1e5b13695fdccb0cfc6926cfb5a8631d86f94f09
+  data.tar.gz: fe3abc900c32f11af2b0c1f432c9b376042b48a9d8e69c293ccc76b7383a97b0
 SHA512:
-  metadata.gz: 39825222126b541eaf3df0b04c5b9784ce7cdc68d6fd837f642cad6e6ce5e6196a709a31154565f97efaea0ab8f1f483417daada360e331990a675880f3f75e6
-  data.tar.gz: f95ddbec1b92a9eeffd0732f31d30005e3fb36d85f3c381454977a7130e24630e32fe4d6fbfbf005f3cefaaa35d5bc264c92aa29403d64aff33050797727505b
+  metadata.gz: 8b79df0b6ab84ce586694fffcf9b9a25e4de2586f85b0430be60f93404df699675e5890936a4ea963f528ed7526b6ffb9e9afe591ee8c8b327952981457654a0
+  data.tar.gz: dec35c52cf5cd36d1b0692a3eb6bb73431f2e07836226af366fd7a8d0c58c964c9577545bf10c01e5178333acbf75a299a63f205bbc3496c557835af5473496b

data/Gemfile

@@ -3,6 +3,7 @@ source "https://rubygems.org"
 gemspec
 
 group :development do
+  gem "thor"
   gem "rake"
   gem "rspec"
   gem "simplecov", require: false

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SHIBATA Hiroshi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/bundler/sbom/cli.rb

@@ -1,31 +1,105 @@
 require "json"
 require "bundler/sbom/generator"
+require "bundler/sbom/reporter"
 
 module Bundler
   module Sbom
     class CLI < Thor
-      desc "dump", "Generate SBOM and save to bom.json"
+      desc "dump", "Generate SBOM and save to file"
+      method_option :format, type: :string, default: "json", desc: "Output format: json or xml", aliases: "-f"
+      method_option :sbom, type: :string, default: "spdx", desc: "SBOM format: spdx or cyclonedx", aliases: "-s"
       def dump
-        sbom = Bundler::Sbom::Generator.generate_sbom
-        File.write("bom.json", JSON.pretty_generate(sbom))
-        Bundler.ui.info("Generated SBOM at bom.json")
-      end
+        format = options[:format].downcase
+        sbom_format = options[:sbom].downcase
 
-      desc "license", "Display license report from existing bom.json"
+        # Validate output format
+        unless ["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported output format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Validate SBOM format
+        unless ["spdx", "cyclonedx"].include?(sbom_format)
+          Bundler.ui.error("Error: Unsupported SBOM format '#{sbom_format}'. Supported formats: spdx, cyclonedx")
+          exit 1
+        end
+
+        # Generate SBOM based on specified format
+        sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format)
+        
+        # Determine file extension based on output format
+        ext = format == "json" ? "json" : "xml"
+        
+        # Determine filename prefix based on SBOM format
+        prefix = sbom_format == "spdx" ? "bom" : "bom-cyclonedx"
+        output_file = "#{prefix}.#{ext}"
+        
+        if format == "json"
+          File.write(output_file, JSON.pretty_generate(sbom))
+        else # xml
+          xml_content = Bundler::Sbom::Generator.convert_to_xml(sbom)
+          File.write(output_file, xml_content)
+        end
+        
+        Bundler.ui.info("Generated #{sbom_format.upcase} SBOM at #{output_file}")
+      end
+      
+      desc "license", "Display license report from SBOM file"
+      method_option :file, type: :string, desc: "Input SBOM file path", aliases: "-f"
+      method_option :format, type: :string, desc: "Input format: json or xml", aliases: "-F"
       def license
-        unless File.exist?("bom.json")
-          Bundler.ui.error("Error: bom.json not found. Run 'bundle sbom dump' first.")
+        format = options[:format]&.downcase
+        input_file = options[:file]
+
+        # Validate format if provided
+        if format && !["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Determine input file based on format or find default files
+        if input_file.nil?
+          if format == "xml" || (format.nil? && File.exist?("bom.xml"))
+            input_file = "bom.xml"
+          elsif File.exist?("bom-cyclonedx.json")
+            input_file = "bom-cyclonedx.json"
+          elsif File.exist?("bom-cyclonedx.xml")
+            input_file = "bom-cyclonedx.xml"
+          else
+            input_file = "bom.json"
+          end
+        end
+
+        unless File.exist?(input_file)
+          file_type = File.extname(input_file) == ".xml" ? "xml" : "json"
+          sbom_type = input_file.include?("cyclonedx") ? "cyclonedx" : "spdx"
+          Bundler.ui.error("Error: #{input_file} not found. Run 'bundle sbom dump --format=#{file_type} --sbom=#{sbom_type}' first.")
           exit 1
         end
 
         begin
-          sbom = JSON.parse(File.read("bom.json"))
-          Bundler::Sbom::Generator.display_license_report(sbom)
+          content = File.read(input_file)
+          
+          sbom = if format == "xml" || (!format && File.extname(input_file) == ".xml")
+            Bundler::Sbom::Generator.parse_xml(content)
+          else
+            JSON.parse(content)
+          end
+          
+          Bundler::Sbom::Reporter.display_license_report(sbom)
         rescue JSON::ParserError
-          Bundler.ui.error("Error: bom.json is not a valid JSON file")
+          Bundler.ui.error("Error: #{input_file} is not a valid JSON file")
+          exit 1
+        rescue StandardError => e
+          Bundler.ui.error("Error processing #{input_file}: #{e.message}")
           exit 1
         end
       end
+
+      # 適切にエラーで終了することを保証するためのメソッド
+      def self.exit_on_failure?
+        true
+      end
     end
   end
 end

data/lib/bundler/sbom/cyclonedx.rb

@@ -0,0 +1,244 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class CycloneDX
+      def self.generate(lockfile, document_name)
+        serial_number = SecureRandom.uuid
+        timestamp = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => "urn:uuid:#{serial_number}",
+          "version" => 1,
+          "metadata" => {
+            "timestamp" => timestamp,
+            "tools" => [
+              {
+                "vendor" => "Bundler",
+                "name" => "bundle-sbom",
+                "version" => Bundler::Sbom::VERSION
+              }
+            ],
+            "component" => {
+              "type" => "application",
+              "name" => document_name,
+              "version" => "0.0.0" # Default version
+            }
+          },
+          "components" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+          rescue Gem::LoadError
+            licenses = []
+          end
+
+          component = {
+            "type" => "library",
+            "name" => spec.name,
+            "version" => spec.version.to_s,
+            "purl" => "pkg:gem/#{spec.name}@#{spec.version}"
+          }
+
+          unless licenses.empty?
+            component["licenses"] = licenses.map { |license| { "license" => { "id" => license } } }
+          end
+
+          sbom["components"] << component
+        end
+
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+        
+        # Root element
+        root = REXML::Element.new("bom")
+        root.add_namespace("http://cyclonedx.org/schema/bom/1.4")
+        root.add_attributes({
+          "serialNumber" => sbom["serialNumber"],
+          "version" => sbom["version"].to_s,
+        })
+        doc.add_element(root)
+        
+        # Metadata
+        metadata = REXML::Element.new("metadata")
+        root.add_element(metadata)
+        
+        add_element(metadata, "timestamp", sbom["metadata"]["timestamp"])
+        
+        # Tools
+        tools = REXML::Element.new("tools")
+        metadata.add_element(tools)
+        
+        sbom["metadata"]["tools"].each do |tool_data|
+          tool = REXML::Element.new("tool")
+          tools.add_element(tool)
+          
+          add_element(tool, "vendor", tool_data["vendor"])
+          add_element(tool, "name", tool_data["name"])
+          add_element(tool, "version", tool_data["version"].to_s)
+        end
+        
+        # Component (root project)
+        component = REXML::Element.new("component")
+        component.add_attribute("type", sbom["metadata"]["component"]["type"])
+        metadata.add_element(component)
+        
+        add_element(component, "name", sbom["metadata"]["component"]["name"])
+        add_element(component, "version", sbom["metadata"]["component"]["version"])
+        
+        # Components
+        components = REXML::Element.new("components")
+        root.add_element(components)
+        
+        sbom["components"].each do |comp_data|
+          comp = REXML::Element.new("component")
+          comp.add_attribute("type", comp_data["type"])
+          components.add_element(comp)
+          
+          add_element(comp, "name", comp_data["name"])
+          add_element(comp, "version", comp_data["version"])
+          add_element(comp, "purl", comp_data["purl"])
+          
+          # Licenses
+          if comp_data["licenses"] && !comp_data["licenses"].empty?
+            licenses = REXML::Element.new("licenses")
+            comp.add_element(licenses)
+            
+            comp_data["licenses"].each do |license_data|
+              license = REXML::Element.new("license")
+              licenses.add_element(license)
+              
+              if license_data["license"]["id"]
+                add_element(license, "id", license_data["license"]["id"])
+              end
+            end
+          end
+        end
+        
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+        
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => root.attributes["serialNumber"],
+          "version" => root.attributes["version"].to_i,
+          "metadata" => {
+            "timestamp" => get_element_text(root, "metadata/timestamp"),
+            "tools" => [],
+            "component" => {
+              "type" => REXML::XPath.first(root, "metadata/component").attributes["type"],
+              "name" => get_element_text(root, "metadata/component/name"),
+              "version" => get_element_text(root, "metadata/component/version")
+            }
+          },
+          "components" => []
+        }
+        
+        # Collect tools
+        REXML::XPath.each(root, "metadata/tools/tool") do |tool|
+          tool_data = {
+            "vendor" => get_element_text(tool, "vendor"),
+            "name" => get_element_text(tool, "name"),
+            "version" => get_element_text(tool, "version")
+          }
+          sbom["metadata"]["tools"] << tool_data
+        end
+        
+        # Collect components
+        REXML::XPath.each(root, "components/component") do |comp|
+          component = {
+            "type" => comp.attributes["type"],
+            "name" => get_element_text(comp, "name"),
+            "version" => get_element_text(comp, "version"),
+            "purl" => get_element_text(comp, "purl")
+          }
+          
+          # Collect licenses
+          licenses = []
+          REXML::XPath.each(comp, "licenses/license") do |license|
+            license_id = get_element_text(license, "id")
+            licenses << { "license" => { "id" => license_id } } if license_id
+          end
+          
+          component["licenses"] = licenses unless licenses.empty?
+          sbom["components"] << component
+        end
+
+        # Convert CycloneDX format to SPDX-like format for compatibility with Reporter
+        converted_sbom = {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+                              comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                            else
+                              "NOASSERTION"
+                            end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+        
+        converted_sbom
+      end
+
+      def self.to_report_format(sbom)
+        {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+                             comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                           else
+                             "NOASSERTION"
+                           end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+      end
+
+      private
+      
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+      
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/generator.rb

@@ -1,117 +1,51 @@
 require "bundler"
 require "securerandom"
+require "json"
+require "rexml/document"
+require "bundler/sbom/spdx"
+require "bundler/sbom/cyclonedx"
 
 module Bundler
   module Sbom
+    class GemfileLockNotFoundError < StandardError; end
+
     class Generator
-      def self.generate_sbom
+      def self.generate_sbom(format = "spdx")
         lockfile_path = Bundler.default_lockfile
-        unless lockfile_path.exist?
-          abort "No Gemfile.lock found. Run `bundle install` first."
+        if !lockfile_path || !lockfile_path.exist?
+          Bundler.ui.error "No Gemfile.lock found. Run `bundle install` first."
+          raise GemfileLockNotFoundError, "No Gemfile.lock found"
         end
 
         lockfile = Bundler::LockfileParser.new(lockfile_path.read)
         document_name = File.basename(Dir.pwd)
-        spdx_id = SecureRandom.uuid
-
-        sbom = {
-          "SPDXID" => "SPDXRef-DOCUMENT",
-          "spdxVersion" => "SPDX-2.2",
-          "creationInfo" => {
-            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
-            "creators" => ["Tool: bundle-sbom"],
-            "licenseListVersion" => "3.17"
-          },
-          "name" => document_name,
-          "dataLicense" => "CC0-1.0",
-          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
-          "packages" => []
-        }
-
-        lockfile.specs.each do |spec|
-          begin
-            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
-            licenses = []
-            if gemspec
-              if gemspec.license && !gemspec.license.empty?
-                licenses << gemspec.license
-              end
-
-              if gemspec.licenses && !gemspec.licenses.empty?
-                licenses.concat(gemspec.licenses)
-              end
 
-              licenses.uniq!
-            end
-
-            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
-          rescue Gem::LoadError
-            license_string = "NOASSERTION"
-          end
-
-          package = {
-            "SPDXID" => "SPDXRef-Package-#{spec.name}",
-            "name" => spec.name,
-            "versionInfo" => spec.version.to_s,
-            "downloadLocation" => "NOASSERTION",
-            "filesAnalyzed" => false,
-            "licenseConcluded" => license_string,
-            "licenseDeclared" => license_string,
-            "supplier" => "NOASSERTION",
-            "externalRefs" => [
-              {
-                "referenceCategory" => "PACKAGE_MANAGER",
-                "referenceType" => "purl",
-                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
-              }
-            ]
-          }
-          sbom["packages"] << package
+        case format.to_s.downcase
+        when "cyclonedx"
+          CycloneDX.generate(lockfile, document_name)
+        else # default to spdx
+          SPDX.generate(lockfile, document_name)
         end
-
-        sbom
       end
 
-      def self.display_license_report(sbom)
-        license_count = analyze_licenses(sbom)
-        sorted_licenses = license_count.sort_by { |_, count| -count }
-
-        puts "=== License Usage in SBOM ==="
-        puts "Total packages: #{sbom["packages"].size}"
-        puts
-
-        sorted_licenses.each do |license, count|
-          puts "#{license}: #{count} package(s)"
-        end
-
-        puts "\n=== Packages by License ==="
-        sorted_licenses.each do |license, _|
-          packages = sbom["packages"].select do |package|
-            if package["licenseDeclared"].include?(",")
-              package["licenseDeclared"].split(",").map(&:strip).include?(license)
-            else
-              package["licenseDeclared"] == license
-            end
-          end
-
-          puts "\n#{license} (#{packages.size} package(s)):"
-          packages.each do |package|
-            puts "  - #{package["name"]} (#{package["versionInfo"]})"
-          end
+      def self.convert_to_xml(sbom)
+        if sbom["bomFormat"] == "CycloneDX"
+          CycloneDX.to_xml(sbom)
+        else
+          SPDX.to_xml(sbom)
         end
       end
 
-      private
-
-      def self.analyze_licenses(sbom)
-        license_count = Hash.new(0)
-        sbom["packages"].each do |package|
-          licenses = package["licenseDeclared"].split(",").map(&:strip)
-          licenses.each do |license|
-            license_count[license] += 1
-          end
+      def self.parse_xml(xml_content)
+        doc = REXML::Document.new(xml_content)
+        root = doc.root
+        
+        # Determine if it's CycloneDX or SPDX
+        if root.name == "bom" && root.namespace.include?("cyclonedx.org")
+          CycloneDX.parse_xml(doc)
+        else
+          SPDX.parse_xml(doc)
         end
-        license_count
       end
     end
   end

data/lib/bundler/sbom/reporter.rb

@@ -0,0 +1,63 @@
+module Bundler
+  module Sbom
+    class Reporter
+      def self.display_license_report(sbom)
+        # フォーマットに応じて適切な形式に変換
+        sbom = if sbom_format(sbom) == :cyclonedx
+          CycloneDX.to_report_format(sbom)
+        else
+          SPDX.to_report_format(sbom)
+        end
+        
+        display_report(sbom)
+      end
+
+      private
+
+      def self.sbom_format(sbom)
+        return :cyclonedx if sbom["bomFormat"] == "CycloneDX"
+        return :spdx
+      end
+
+      def self.display_report(sbom)
+        license_count = analyze_licenses(sbom)
+        sorted_licenses = license_count.sort_by { |_, count| -count }
+
+        puts "=== License Usage in SBOM ==="
+        puts "Total packages: #{sbom["packages"].size}"
+        puts
+
+        sorted_licenses.each do |license, count|
+          puts "#{license}: #{count} package(s)"
+        end
+
+        puts "\n=== Packages by License ==="
+        sorted_licenses.each do |license, _|
+          packages = sbom["packages"].select do |package|
+            if package["licenseDeclared"].include?(",")
+              package["licenseDeclared"].split(",").map(&:strip).include?(license)
+            else
+              package["licenseDeclared"] == license
+            end
+          end
+
+          puts "\n#{license} (#{packages.size} package(s)):"
+          packages.each do |package|
+            puts "  - #{package["name"]} (#{package["versionInfo"]})"
+          end
+        end
+      end
+
+      def self.analyze_licenses(sbom)
+        license_count = Hash.new(0)
+        sbom["packages"].each do |package|
+          licenses = package["licenseDeclared"].split(",").map(&:strip)
+          licenses.each do |license|
+            license_count[license] += 1
+          end
+        end
+        license_count
+      end
+    end
+  end
+end

data/lib/bundler/sbom/spdx.rb

@@ -0,0 +1,220 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class SPDX
+      def self.generate(lockfile, document_name)
+        spdx_id = SecureRandom.uuid
+        sbom = {
+          "SPDXID" => "SPDXRef-DOCUMENT",
+          "spdxVersion" => "SPDX-2.3",
+          "creationInfo" => {
+            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "creators" => ["Tool: bundle-sbom"],
+            "licenseListVersion" => "3.20"
+          },
+          "name" => document_name,
+          "dataLicense" => "CC0-1.0",
+          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
+          "packages" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
+          rescue Gem::LoadError
+            license_string = "NOASSERTION"
+          end
+
+          package = {
+            "SPDXID" => "SPDXRef-Package-#{spec.name}",
+            "name" => spec.name,
+            "versionInfo" => spec.version.to_s,
+            "downloadLocation" => "NOASSERTION",
+            "filesAnalyzed" => false,
+            "licenseConcluded" => license_string,
+            "licenseDeclared" => license_string,
+            "copyrightText" => "NOASSERTION",
+            "supplier" => "NOASSERTION",
+            "externalRefs" => [
+              {
+                "referenceCategory" => "PACKAGE_MANAGER",
+                "referenceType" => "purl",
+                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
+              }
+            ]
+          }
+          sbom["packages"] << package
+        end
+
+        sbom["documentDescribes"] = sbom["packages"].map { |p| p["SPDXID"] }
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+        
+        # Root element
+        root = REXML::Element.new("SpdxDocument")
+        root.add_namespace("https://spdx.org/spdxdocs/")
+        doc.add_element(root)
+        
+        # Document info
+        add_element(root, "SPDXID", sbom["SPDXID"])
+        add_element(root, "spdxVersion", sbom["spdxVersion"])
+        add_element(root, "name", sbom["name"])
+        add_element(root, "dataLicense", sbom["dataLicense"])
+        add_element(root, "documentNamespace", sbom["documentNamespace"])
+        
+        # Creation info
+        creation_info = REXML::Element.new("creationInfo")
+        root.add_element(creation_info)
+        add_element(creation_info, "created", sbom["creationInfo"]["created"])
+        add_element(creation_info, "licenseListVersion", sbom["creationInfo"]["licenseListVersion"])
+        
+        sbom["creationInfo"]["creators"].each do |creator|
+          add_element(creation_info, "creator", creator)
+        end
+        
+        # Describes
+        sbom["documentDescribes"].each do |describes|
+          add_element(root, "documentDescribes", describes)
+        end
+        
+        # Packages
+        sbom["packages"].each do |pkg|
+          package = REXML::Element.new("package")
+          root.add_element(package)
+          
+          add_element(package, "SPDXID", pkg["SPDXID"])
+          add_element(package, "name", pkg["name"])
+          add_element(package, "versionInfo", pkg["versionInfo"])
+          add_element(package, "downloadLocation", pkg["downloadLocation"])
+          add_element(package, "filesAnalyzed", pkg["filesAnalyzed"].to_s)
+          add_element(package, "licenseConcluded", pkg["licenseConcluded"])
+          add_element(package, "licenseDeclared", pkg["licenseDeclared"])
+          add_element(package, "copyrightText", pkg["copyrightText"])
+          add_element(package, "supplier", pkg["supplier"])
+          
+          # External references
+          if pkg["externalRefs"]
+            pkg["externalRefs"].each do |ref|
+              ext_ref = REXML::Element.new("externalRef")
+              package.add_element(ext_ref)
+              
+              add_element(ext_ref, "referenceCategory", ref["referenceCategory"])
+              add_element(ext_ref, "referenceType", ref["referenceType"])
+              add_element(ext_ref, "referenceLocator", ref["referenceLocator"])
+            end
+          end
+        end
+        
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+        
+        sbom = {
+          "SPDXID" => get_element_text(root, "SPDXID"),
+          "spdxVersion" => get_element_text(root, "spdxVersion"),
+          "name" => get_element_text(root, "name"),
+          "dataLicense" => get_element_text(root, "dataLicense"),
+          "documentNamespace" => get_element_text(root, "documentNamespace"),
+          "creationInfo" => {
+            "created" => get_element_text(root, "creationInfo/created"),
+            "licenseListVersion" => get_element_text(root, "creationInfo/licenseListVersion"),
+            "creators" => []
+          },
+          "packages" => [],
+          "documentDescribes" => []
+        }
+        
+        # Collect creators
+        REXML::XPath.each(root, "creationInfo/creator") do |creator|
+          sbom["creationInfo"]["creators"] << creator.text
+        end
+        
+        # Collect documentDescribes
+        REXML::XPath.each(root, "documentDescribes") do |describes|
+          sbom["documentDescribes"] << describes.text
+        end
+        
+        # Collect packages
+        REXML::XPath.each(root, "package") do |pkg_element|
+          package = {
+            "SPDXID" => get_element_text(pkg_element, "SPDXID"),
+            "name" => get_element_text(pkg_element, "name"),
+            "versionInfo" => get_element_text(pkg_element, "versionInfo"),
+            "downloadLocation" => get_element_text(pkg_element, "downloadLocation"),
+            "filesAnalyzed" => get_element_text(pkg_element, "filesAnalyzed") == "true",
+            "licenseConcluded" => get_element_text(pkg_element, "licenseConcluded"),
+            "licenseDeclared" => get_element_text(pkg_element, "licenseDeclared"),
+            "copyrightText" => get_element_text(pkg_element, "copyrightText"),
+            "supplier" => get_element_text(pkg_element, "supplier"),
+            "externalRefs" => []
+          }
+          
+          # Collect external references
+          REXML::XPath.each(pkg_element, "externalRef") do |ref_element|
+            ref = {
+              "referenceCategory" => get_element_text(ref_element, "referenceCategory"),
+              "referenceType" => get_element_text(ref_element, "referenceType"),
+              "referenceLocator" => get_element_text(ref_element, "referenceLocator")
+            }
+            package["externalRefs"] << ref
+          end
+          
+          sbom["packages"] << package
+        end
+        
+        sbom
+      end
+
+      def self.to_report_format(sbom)
+        # SPDXフォーマットは既にレポート形式と互換性があるため、
+        # packagesセクションだけを抽出して返す
+        {
+          "packages" => sbom["packages"].map do |pkg|
+            {
+              "name" => pkg["name"],
+              "versionInfo" => pkg["versionInfo"],
+              "licenseDeclared" => pkg["licenseDeclared"]
+            }
+          end
+        }
+      end
+
+      private
+      
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+      
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Sbom
-    VERSION = "0.1.5"
+    VERSION = "0.1.7"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bundler-sbom
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - SHIBATA Hiroshi
 bindir: exe
 cert_chain: []
-date: 2025-03-05 00:00:00.000000000 Z
+date: 2025-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -23,7 +23,21 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
-description: Generate CycloneDX SBOM(Software Bill of Materials) files with Bundler
+- !ruby/object:Gem::Dependency
+  name: rexml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 email:
 - hsbt@ruby-lang.org
 executables: []
@@ -31,15 +45,20 @@ extensions: []
 extra_rdoc_files: []
 files:
 - Gemfile
+- LICENSE
 - README.md
 - Rakefile
 - lib/bundler/sbom.rb
 - lib/bundler/sbom/cli.rb
+- lib/bundler/sbom/cyclonedx.rb
 - lib/bundler/sbom/generator.rb
+- lib/bundler/sbom/reporter.rb
+- lib/bundler/sbom/spdx.rb
 - lib/bundler/sbom/version.rb
 - plugins.rb
 homepage: https://github.com/hsbt/bundler-sbom
-licenses: []
+licenses:
+- MIT
 metadata:
   homepage_uri: https://github.com/hsbt/bundler-sbom
   source_code_uri: https://github.com/hsbt/bundler-sbom
@@ -52,7 +71,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -61,5 +80,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.2
 specification_version: 4
-summary: Generate CycloneDX SBOM(Software Bill of Materials) files with Bundler
+summary: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 test_files: []