bundler-sbom 0.1.6 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb720a4c1407de48380f89d81cfb76c76c9aaf72477e06de9d42e2154b278ddf
-  data.tar.gz: '0596c33babc35714c4515f6eb7f018bbabbe22350734650c060f34788a28bb0f'
+  metadata.gz: 590a4da5b45a12b7d7946aa14626eae531db3220a2441047895db77c078ccf4b
+  data.tar.gz: 525d811c49ee31132eafbccc53e96d7fc4b39e92cd1dac8c704da334120584d4
 SHA512:
-  metadata.gz: a1878c226f0f1dc92967c05dcb52539de886734eed0395a734164c426d14cffcccebf53c13dab7f5113c4497efe44c9b7bcca2898d638a1f84cc88362502f1f8
-  data.tar.gz: 5fb51be53f651ec22422f33fdbb8859842cef43911681ed70d104f9582856f741816491df1a8b67a322122f4eecb21355dabdd9e6d103ab85016f08ea5506a90
+  metadata.gz: a4bc5d533a846c9c0786f5fcc17d9ca6f85fe6bbd72719ff016caeebedd2a6e6b68fef6d86c59fced37a5a96a1c601eb5f6fbda00554a67b3e2cb287b1c95a37
+  data.tar.gz: b7e135ea95bbdc7cb93b90864f7f0daf75cda5640f6be982813f6d156d7942bfb4d6c8da8df7f688fb1399afdf9d30d428e75bb4dfcccb4db0ff6fe905d44b9c

data/Gemfile

@@ -9,4 +9,4 @@ group :development do
   gem "simplecov", require: false
   gem "rspec-its"
   gem "rspec-mocks"
-end
+end

data/README.md

@@ -14,24 +14,62 @@ $ bundler plugin install bundler-sbom
 
 ### Generate SBOM
 
-To generate an SBOM file in SPDX format from your project's Gemfile.lock:
+To generate an SBOM file from your project's Gemfile.lock:
 
 ```
-$ bundle sbom dump
+$ bundle sbom dump [options]
 ```
 
-This will create a `bom.json` file in your project directory.
+Available options:
+- `-f, --format FORMAT`: Output format (json or xml, default: json)
+- `-s, --sbom FORMAT`: SBOM specification format (spdx or cyclonedx, default: spdx)
+
+Generated files will be named according to the following pattern:
+- SPDX format: `bom.json` or `bom.xml`
+- CycloneDX format: `bom-cyclonedx.json` or `bom-cyclonedx.xml`
+
+Examples:
+```
+$ bundle sbom dump                           # Generates SPDX format in JSON (bom.json)
+$ bundle sbom dump -f xml                    # Generates SPDX format in XML (bom.xml)
+$ bundle sbom dump -s cyclonedx             # Generates CycloneDX format in JSON (bom-cyclonedx.json)
+$ bundle sbom dump -s cyclonedx -f xml      # Generates CycloneDX format in XML (bom-cyclonedx.xml)
+```
 
 ### Analyze License Information
 
 To view a summary of licenses used in your project's dependencies:
 
 ```
-$ bundle sbom license
+$ bundle sbom license [options]
 ```
 
+Available options:
+- `-f, --file PATH`: Input SBOM file path
+- `-F, --format FORMAT`: Input format (json or xml)
+
+If no options are specified, the command will automatically look for SBOM files in the following order:
+1. `bom.xml` (if format is xml)
+2. `bom-cyclonedx.json`
+3. `bom-cyclonedx.xml`
+4. `bom.json`
+
 This command will show:
 - A count of packages using each license
 - A detailed list of packages grouped by license
 
-Note: The `license` command requires that you've already generated the SBOM using `bundle sbom dump`.
+Note: The `license` command requires that you've already generated the SBOM using `bundle sbom dump`.
+
+## Supported SBOM Formats
+
+### SPDX
+[SPDX (Software Package Data Exchange)](https://spdx.dev/) is a standard format for communicating software bill of material information, including components, licenses, copyrights, and security references.
+
+### CycloneDX
+[CycloneDX](https://cyclonedx.org/) is a lightweight SBOM specification designed for use in application security contexts and supply chain component analysis.
+
+## References
+
+- [SPDX Specification](https://spdx.github.io/spdx-spec/)
+- [CycloneDX Specification](https://cyclonedx.org/specification/overview/)
+- [About Software Bill of Materials (SBOM)](https://www.cisa.gov/sbom)

data/Rakefile

@@ -3,4 +3,4 @@ require "rspec/core/rake_task"
 
 RSpec::Core::RakeTask.new(:spec)
 
-task :default => :spec
+task default: :spec

data/lib/bundler/sbom/cli.rb

@@ -5,28 +5,101 @@ require "bundler/sbom/reporter"
 module Bundler
   module Sbom
     class CLI < Thor
-      desc "dump", "Generate SBOM and save to bom.json"
+      desc "dump", "Generate SBOM and save to file"
+      method_option :format, type: :string, default: "json", desc: "Output format: json or xml", aliases: "-f"
+      method_option :sbom, type: :string, default: "spdx", desc: "SBOM format: spdx or cyclonedx", aliases: "-s"
       def dump
-        sbom = Bundler::Sbom::Generator.generate_sbom
-        File.write("bom.json", JSON.pretty_generate(sbom))
-        Bundler.ui.info("Generated SBOM at bom.json")
+        format = options[:format].downcase
+        sbom_format = options[:sbom].downcase
+
+        # Validate output format
+        unless ["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported output format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Validate SBOM format
+        unless ["spdx", "cyclonedx"].include?(sbom_format)
+          Bundler.ui.error("Error: Unsupported SBOM format '#{sbom_format}'. Supported formats: spdx, cyclonedx")
+          exit 1
+        end
+
+        # Generate SBOM based on specified format
+        sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format)
+
+        # Determine file extension based on output format
+        ext = format == "json" ? "json" : "xml"
+
+        # Determine filename prefix based on SBOM format
+        prefix = sbom_format == "spdx" ? "bom" : "bom-cyclonedx"
+        output_file = "#{prefix}.#{ext}"
+
+        if format == "json"
+          File.write(output_file, JSON.pretty_generate(sbom))
+        else # xml
+          xml_content = Bundler::Sbom::Generator.convert_to_xml(sbom)
+          File.write(output_file, xml_content)
+        end
+
+        Bundler.ui.info("Generated #{sbom_format.upcase} SBOM at #{output_file}")
       end
 
-      desc "license", "Display license report from existing bom.json"
+      desc "license", "Display license report from SBOM file"
+      method_option :file, type: :string, desc: "Input SBOM file path", aliases: "-f"
+      method_option :format, type: :string, desc: "Input format: json or xml", aliases: "-F"
       def license
-        unless File.exist?("bom.json")
-          Bundler.ui.error("Error: bom.json not found. Run 'bundle sbom dump' first.")
+        format = options[:format]&.downcase
+        input_file = options[:file]
+
+        # Validate format if provided
+        if format && !["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Determine input file based on format or find default files
+        if input_file.nil?
+          if format == "xml" || (format.nil? && File.exist?("bom.xml"))
+            input_file = "bom.xml"
+          elsif File.exist?("bom-cyclonedx.json")
+            input_file = "bom-cyclonedx.json"
+          elsif File.exist?("bom-cyclonedx.xml")
+            input_file = "bom-cyclonedx.xml"
+          else
+            input_file = "bom.json"
+          end
+        end
+
+        unless File.exist?(input_file)
+          file_type = File.extname(input_file) == ".xml" ? "xml" : "json"
+          sbom_type = input_file.include?("cyclonedx") ? "cyclonedx" : "spdx"
+          Bundler.ui.error("Error: #{input_file} not found. Run 'bundle sbom dump --format=#{file_type} --sbom=#{sbom_type}' first.")
           exit 1
         end
 
         begin
-          sbom = JSON.parse(File.read("bom.json"))
+          content = File.read(input_file)
+
+          sbom = if format == "xml" || (!format && File.extname(input_file) == ".xml")
+            Bundler::Sbom::Generator.parse_xml(content)
+          else
+            JSON.parse(content)
+          end
+
           Bundler::Sbom::Reporter.display_license_report(sbom)
         rescue JSON::ParserError
-          Bundler.ui.error("Error: bom.json is not a valid JSON file")
+          Bundler.ui.error("Error: #{input_file} is not a valid JSON file")
+          exit 1
+        rescue StandardError => e
+          Bundler.ui.error("Error processing #{input_file}: #{e.message}")
           exit 1
         end
       end
+
+      # 適切にエラーで終了することを保証するためのメソッド
+      def self.exit_on_failure?
+        true
+      end
     end
   end
-end
+end

data/lib/bundler/sbom/cyclonedx.rb

@@ -0,0 +1,244 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class CycloneDX
+      def self.generate(lockfile, document_name)
+        serial_number = SecureRandom.uuid
+        timestamp = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => "urn:uuid:#{serial_number}",
+          "version" => 1,
+          "metadata" => {
+            "timestamp" => timestamp,
+            "tools" => [
+              {
+                "vendor" => "Bundler",
+                "name" => "bundle-sbom",
+                "version" => Bundler::Sbom::VERSION
+              }
+            ],
+            "component" => {
+              "type" => "application",
+              "name" => document_name,
+              "version" => "0.0.0" # Default version
+            }
+          },
+          "components" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+          rescue Gem::LoadError
+            licenses = []
+          end
+
+          component = {
+            "type" => "library",
+            "name" => spec.name,
+            "version" => spec.version.to_s,
+            "purl" => "pkg:gem/#{spec.name}@#{spec.version}"
+          }
+
+          unless licenses.empty?
+            component["licenses"] = licenses.map { |license| { "license" => { "id" => license } } }
+          end
+
+          sbom["components"] << component
+        end
+
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+
+        # Root element
+        root = REXML::Element.new("bom")
+        root.add_namespace("http://cyclonedx.org/schema/bom/1.4")
+        root.add_attributes({
+          "serialNumber" => sbom["serialNumber"],
+          "version" => sbom["version"].to_s,
+        })
+        doc.add_element(root)
+
+        # Metadata
+        metadata = REXML::Element.new("metadata")
+        root.add_element(metadata)
+
+        add_element(metadata, "timestamp", sbom["metadata"]["timestamp"])
+
+        # Tools
+        tools = REXML::Element.new("tools")
+        metadata.add_element(tools)
+
+        sbom["metadata"]["tools"].each do |tool_data|
+          tool = REXML::Element.new("tool")
+          tools.add_element(tool)
+
+          add_element(tool, "vendor", tool_data["vendor"])
+          add_element(tool, "name", tool_data["name"])
+          add_element(tool, "version", tool_data["version"].to_s)
+        end
+
+        # Component (root project)
+        component = REXML::Element.new("component")
+        component.add_attribute("type", sbom["metadata"]["component"]["type"])
+        metadata.add_element(component)
+
+        add_element(component, "name", sbom["metadata"]["component"]["name"])
+        add_element(component, "version", sbom["metadata"]["component"]["version"])
+
+        # Components
+        components = REXML::Element.new("components")
+        root.add_element(components)
+
+        sbom["components"].each do |comp_data|
+          comp = REXML::Element.new("component")
+          comp.add_attribute("type", comp_data["type"])
+          components.add_element(comp)
+
+          add_element(comp, "name", comp_data["name"])
+          add_element(comp, "version", comp_data["version"])
+          add_element(comp, "purl", comp_data["purl"])
+
+          # Licenses
+          if comp_data["licenses"] && !comp_data["licenses"].empty?
+            licenses = REXML::Element.new("licenses")
+            comp.add_element(licenses)
+
+            comp_data["licenses"].each do |license_data|
+              license = REXML::Element.new("license")
+              licenses.add_element(license)
+
+              if license_data["license"]["id"]
+                add_element(license, "id", license_data["license"]["id"])
+              end
+            end
+          end
+        end
+
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => root.attributes["serialNumber"],
+          "version" => root.attributes["version"].to_i,
+          "metadata" => {
+            "timestamp" => get_element_text(root, "metadata/timestamp"),
+            "tools" => [],
+            "component" => {
+              "type" => REXML::XPath.first(root, "metadata/component").attributes["type"],
+              "name" => get_element_text(root, "metadata/component/name"),
+              "version" => get_element_text(root, "metadata/component/version")
+            }
+          },
+          "components" => []
+        }
+
+        # Collect tools
+        REXML::XPath.each(root, "metadata/tools/tool") do |tool|
+          tool_data = {
+            "vendor" => get_element_text(tool, "vendor"),
+            "name" => get_element_text(tool, "name"),
+            "version" => get_element_text(tool, "version")
+          }
+          sbom["metadata"]["tools"] << tool_data
+        end
+
+        # Collect components
+        REXML::XPath.each(root, "components/component") do |comp|
+          component = {
+            "type" => comp.attributes["type"],
+            "name" => get_element_text(comp, "name"),
+            "version" => get_element_text(comp, "version"),
+            "purl" => get_element_text(comp, "purl")
+          }
+
+          # Collect licenses
+          licenses = []
+          REXML::XPath.each(comp, "licenses/license") do |license|
+            license_id = get_element_text(license, "id")
+            licenses << { "license" => { "id" => license_id } } if license_id
+          end
+
+          component["licenses"] = licenses unless licenses.empty?
+          sbom["components"] << component
+        end
+
+        # Convert CycloneDX format to SPDX-like format for compatibility with Reporter
+        converted_sbom = {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+              comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                            else
+                              "NOASSERTION"
+            end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+
+        converted_sbom
+      end
+
+      def self.to_report_format(sbom)
+        {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+              comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                           else
+                             "NOASSERTION"
+            end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+      end
+
+      private
+
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/generator.rb

@@ -1,12 +1,16 @@
 require "bundler"
 require "securerandom"
+require "json"
+require "rexml/document"
+require "bundler/sbom/spdx"
+require "bundler/sbom/cyclonedx"
 
 module Bundler
   module Sbom
     class GemfileLockNotFoundError < StandardError; end
 
     class Generator
-      def self.generate_sbom
+      def self.generate_sbom(format = "spdx")
         lockfile_path = Bundler.default_lockfile
         if !lockfile_path || !lockfile_path.exist?
           Bundler.ui.error "No Gemfile.lock found. Run `bundle install` first."
@@ -15,67 +19,34 @@ module Bundler
 
         lockfile = Bundler::LockfileParser.new(lockfile_path.read)
         document_name = File.basename(Dir.pwd)
-        spdx_id = SecureRandom.uuid
 
-        sbom = {
-          "SPDXID" => "SPDXRef-DOCUMENT",
-          "spdxVersion" => "SPDX-2.2",
-          "creationInfo" => {
-            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
-            "creators" => ["Tool: bundle-sbom"],
-            "licenseListVersion" => "3.17"
-          },
-          "name" => document_name,
-          "dataLicense" => "CC0-1.0",
-          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
-          "packages" => []
-        }
-
-        lockfile.specs.each do |spec|
-          begin
-            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
-            licenses = []
-            if gemspec
-              if gemspec.license && !gemspec.license.empty?
-                licenses << gemspec.license
-              end
-
-              if gemspec.licenses && !gemspec.licenses.empty?
-                licenses.concat(gemspec.licenses)
-              end
+        case format.to_s.downcase
+        when "cyclonedx"
+          CycloneDX.generate(lockfile, document_name)
+        else # default to spdx
+          SPDX.generate(lockfile, document_name)
+        end
+      end
 
-              licenses.uniq!
-            end
+      def self.convert_to_xml(sbom)
+        if sbom["bomFormat"] == "CycloneDX"
+          CycloneDX.to_xml(sbom)
+        else
+          SPDX.to_xml(sbom)
+        end
+      end
 
-            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
-          rescue Gem::LoadError
-            license_string = "NOASSERTION"
-          end
+      def self.parse_xml(xml_content)
+        doc = REXML::Document.new(xml_content)
+        root = doc.root
 
-          package = {
-            "SPDXID" => "SPDXRef-Package-#{spec.name}",
-            "name" => spec.name,
-            "versionInfo" => spec.version.to_s,
-            "downloadLocation" => "NOASSERTION",
-            "filesAnalyzed" => false,
-            "licenseConcluded" => license_string,
-            "licenseDeclared" => license_string,
-            "copyrightText" => "NOASSERTION",
-            "supplier" => "NOASSERTION",
-            "externalRefs" => [
-              {
-                "referenceCategory" => "PACKAGE_MANAGER",
-                "referenceType" => "purl",
-                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
-              }
-            ]
-          }
-          sbom["packages"] << package
+        # Determine if it's CycloneDX or SPDX
+        if root.name == "bom" && root.namespace.include?("cyclonedx.org")
+          CycloneDX.parse_xml(doc)
+        else
+          SPDX.parse_xml(doc)
         end
-
-        sbom["documentDescribes"] = sbom["packages"].map { |p| p["SPDXID"] }
-        sbom
       end
     end
   end
-end
+end

data/lib/bundler/sbom/reporter.rb

@@ -2,6 +2,24 @@ module Bundler
   module Sbom
     class Reporter
       def self.display_license_report(sbom)
+        # フォーマットに応じて適切な形式に変換
+        sbom = if sbom_format(sbom) == :cyclonedx
+          CycloneDX.to_report_format(sbom)
+        else
+          SPDX.to_report_format(sbom)
+        end
+
+        display_report(sbom)
+      end
+
+      private
+
+      def self.sbom_format(sbom)
+        return :cyclonedx if sbom["bomFormat"] == "CycloneDX"
+        return :spdx
+      end
+
+      def self.display_report(sbom)
         license_count = analyze_licenses(sbom)
         sorted_licenses = license_count.sort_by { |_, count| -count }
 
@@ -30,8 +48,6 @@ module Bundler
         end
       end
 
-      private
-
       def self.analyze_licenses(sbom)
         license_count = Hash.new(0)
         sbom["packages"].each do |package|
@@ -44,4 +60,4 @@ module Bundler
       end
     end
   end
-end
+end

data/lib/bundler/sbom/spdx.rb

@@ -0,0 +1,222 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class SPDX
+      def self.generate(lockfile, document_name)
+        spdx_id = generate_spdx_id
+        sbom = {
+          "SPDXID" => "SPDXRef-DOCUMENT",
+          "spdxVersion" => "SPDX-2.3",
+          "creationInfo" => {
+            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "creators" => ["Tool: bundle-sbom"],
+            "licenseListVersion" => "3.20"
+          },
+          "name" => document_name,
+          "dataLicense" => "CC0-1.0",
+          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
+          "packages" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
+          rescue Gem::LoadError
+            license_string = "NOASSERTION"
+          end
+
+          package = {
+            "SPDXID" => "SPDXRef-Package-#{spec.name}",
+            "name" => spec.name,
+            "versionInfo" => spec.version.to_s,
+            "downloadLocation" => "NOASSERTION",
+            "filesAnalyzed" => false,
+            "licenseConcluded" => license_string,
+            "licenseDeclared" => license_string,
+            "copyrightText" => "NOASSERTION",
+            "supplier" => "NOASSERTION",
+            "externalRefs" => [
+              {
+                "referenceCategory" => "PACKAGE_MANAGER",
+                "referenceType" => "purl",
+                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
+              }
+            ]
+          }
+          sbom["packages"] << package
+        end
+
+        sbom["documentDescribes"] = sbom["packages"].map { |p| p["SPDXID"] }
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+
+        # Root element
+        root = REXML::Element.new("SpdxDocument")
+        root.add_namespace("https://spdx.org/spdxdocs/")
+        doc.add_element(root)
+
+        # Document info
+        add_element(root, "SPDXID", sbom["SPDXID"])
+        add_element(root, "spdxVersion", sbom["spdxVersion"])
+        add_element(root, "name", sbom["name"])
+        add_element(root, "dataLicense", sbom["dataLicense"])
+        add_element(root, "documentNamespace", sbom["documentNamespace"])
+
+        # Creation info
+        creation_info = REXML::Element.new("creationInfo")
+        root.add_element(creation_info)
+        add_element(creation_info, "created", sbom["creationInfo"]["created"])
+        add_element(creation_info, "licenseListVersion", sbom["creationInfo"]["licenseListVersion"])
+
+        sbom["creationInfo"]["creators"].each do |creator|
+          add_element(creation_info, "creator", creator)
+        end
+
+        # Describes
+        sbom["documentDescribes"].each do |describes|
+          add_element(root, "documentDescribes", describes)
+        end
+
+        # Packages
+        sbom["packages"].each do |pkg|
+          package = REXML::Element.new("package")
+          root.add_element(package)
+
+          add_element(package, "SPDXID", pkg["SPDXID"])
+          add_element(package, "name", pkg["name"])
+          add_element(package, "versionInfo", pkg["versionInfo"])
+          add_element(package, "downloadLocation", pkg["downloadLocation"])
+          add_element(package, "filesAnalyzed", pkg["filesAnalyzed"].to_s)
+          add_element(package, "licenseConcluded", pkg["licenseConcluded"])
+          add_element(package, "licenseDeclared", pkg["licenseDeclared"])
+          add_element(package, "copyrightText", pkg["copyrightText"])
+          add_element(package, "supplier", pkg["supplier"])
+
+          # External references
+          if pkg["externalRefs"]
+            pkg["externalRefs"].each do |ref|
+              ext_ref = REXML::Element.new("externalRef")
+              package.add_element(ext_ref)
+
+              add_element(ext_ref, "referenceCategory", ref["referenceCategory"])
+              add_element(ext_ref, "referenceType", ref["referenceType"])
+              add_element(ext_ref, "referenceLocator", ref["referenceLocator"])
+            end
+          end
+        end
+
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+
+        sbom = {
+          "SPDXID" => get_element_text(root, "SPDXID"),
+          "spdxVersion" => get_element_text(root, "spdxVersion"),
+          "name" => get_element_text(root, "name"),
+          "dataLicense" => get_element_text(root, "dataLicense"),
+          "documentNamespace" => get_element_text(root, "documentNamespace"),
+          "creationInfo" => {
+            "created" => get_element_text(root, "creationInfo/created"),
+            "licenseListVersion" => get_element_text(root, "creationInfo/licenseListVersion"),
+            "creators" => []
+          },
+          "packages" => [],
+          "documentDescribes" => []
+        }
+
+        # Collect creators
+        REXML::XPath.each(root, "creationInfo/creator") do |creator|
+          sbom["creationInfo"]["creators"] << creator.text
+        end
+
+        # Collect documentDescribes
+        REXML::XPath.each(root, "documentDescribes") do |describes|
+          sbom["documentDescribes"] << describes.text
+        end
+
+        # Collect packages
+        REXML::XPath.each(root, "package") do |pkg_element|
+          package = {
+            "SPDXID" => get_element_text(pkg_element, "SPDXID"),
+            "name" => get_element_text(pkg_element, "name"),
+            "versionInfo" => get_element_text(pkg_element, "versionInfo"),
+            "downloadLocation" => get_element_text(pkg_element, "downloadLocation"),
+            "filesAnalyzed" => get_element_text(pkg_element, "filesAnalyzed") == "true",
+            "licenseConcluded" => get_element_text(pkg_element, "licenseConcluded"),
+            "licenseDeclared" => get_element_text(pkg_element, "licenseDeclared"),
+            "copyrightText" => get_element_text(pkg_element, "copyrightText"),
+            "supplier" => get_element_text(pkg_element, "supplier"),
+            "externalRefs" => []
+          }
+
+          # Collect external references
+          REXML::XPath.each(pkg_element, "externalRef") do |ref_element|
+            ref = {
+              "referenceCategory" => get_element_text(ref_element, "referenceCategory"),
+              "referenceType" => get_element_text(ref_element, "referenceType"),
+              "referenceLocator" => get_element_text(ref_element, "referenceLocator")
+            }
+            package["externalRefs"] << ref
+          end
+
+          sbom["packages"] << package
+        end
+
+        sbom
+      end
+
+      def self.to_report_format(sbom)
+        # SPDXフォーマットは既にレポート形式と互換性があるため、
+        # packagesセクションだけを抽出して返す
+        {
+          "packages" => sbom["packages"].map do |pkg|
+            {
+              "name" => pkg["name"],
+              "versionInfo" => pkg["versionInfo"],
+              "licenseDeclared" => pkg["licenseDeclared"]
+            }
+          end
+        }
+      end
+
+      def self.generate_spdx_id
+        SecureRandom.uuid
+      end
+
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Sbom
-    VERSION = "0.1.6"
+    VERSION = "0.1.8"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bundler-sbom
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.8
 platform: ruby
 authors:
 - SHIBATA Hiroshi
 bindir: exe
 cert_chain: []
-date: 2025-03-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rexml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 email:
 - hsbt@ruby-lang.org
@@ -36,8 +50,10 @@ files:
 - Rakefile
 - lib/bundler/sbom.rb
 - lib/bundler/sbom/cli.rb
+- lib/bundler/sbom/cyclonedx.rb
 - lib/bundler/sbom/generator.rb
 - lib/bundler/sbom/reporter.rb
+- lib/bundler/sbom/spdx.rb
 - lib/bundler/sbom/version.rb
 - plugins.rb
 homepage: https://github.com/hsbt/bundler-sbom
@@ -55,14 +71,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 test_files: []