bundler-sbom 0.1.8 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 590a4da5b45a12b7d7946aa14626eae531db3220a2441047895db77c078ccf4b
-  data.tar.gz: 525d811c49ee31132eafbccc53e96d7fc4b39e92cd1dac8c704da334120584d4
+  metadata.gz: f578e54cb4d73e62b18d305684a0ff770edb7cde70b31fdd8cb9eaa7b53e0885
+  data.tar.gz: 9e853789b6b01962185dde4a528f84c1e1f16f4432d4a9c5f57b16d5680e0489
 SHA512:
-  metadata.gz: a4bc5d533a846c9c0786f5fcc17d9ca6f85fe6bbd72719ff016caeebedd2a6e6b68fef6d86c59fced37a5a96a1c601eb5f6fbda00554a67b3e2cb287b1c95a37
-  data.tar.gz: b7e135ea95bbdc7cb93b90864f7f0daf75cda5640f6be982813f6d156d7942bfb4d6c8da8df7f688fb1399afdf9d30d428e75bb4dfcccb4db0ff6fe905d44b9c
+  metadata.gz: 4bd4342d874517d03999ba5166fac776610ae3832d79eb620732de9cb7fa6e82614b61ba52a1dc89c79580d1985dad790c6f2ca4c641fd10afbc65ed32fe1b85
+  data.tar.gz: 9f30c4813af67c7882dcec7d132e8c324bc243d6f8fb19cef7a8571a9678fbbf0b92d15fd1a598f0afe6f73497faeea428bbbcd3d03838f3347380f4e44f722c

data/lib/bundler/sbom/cli.rb

@@ -28,10 +28,10 @@ module Bundler
         sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format)
 
         # Determine file extension based on output format
-        ext = format == "json" ? "json" : "xml"
+        ext = (format == "json") ? "json" : "xml"
 
         # Determine filename prefix based on SBOM format
-        prefix = sbom_format == "spdx" ? "bom" : "bom-cyclonedx"
+        prefix = (sbom_format == "spdx") ? "bom" : "bom-cyclonedx"
         output_file = "#{prefix}.#{ext}"
 
         if format == "json"
@@ -59,19 +59,19 @@ module Bundler
 
         # Determine input file based on format or find default files
         if input_file.nil?
-          if format == "xml" || (format.nil? && File.exist?("bom.xml"))
-            input_file = "bom.xml"
+          input_file = if format == "xml" || (format.nil? && File.exist?("bom.xml"))
+            "bom.xml"
           elsif File.exist?("bom-cyclonedx.json")
-            input_file = "bom-cyclonedx.json"
+            "bom-cyclonedx.json"
           elsif File.exist?("bom-cyclonedx.xml")
-            input_file = "bom-cyclonedx.xml"
+            "bom-cyclonedx.xml"
           else
-            input_file = "bom.json"
+            "bom.json"
           end
         end
 
         unless File.exist?(input_file)
-          file_type = File.extname(input_file) == ".xml" ? "xml" : "json"
+          file_type = (File.extname(input_file) == ".xml") ? "xml" : "json"
           sbom_type = input_file.include?("cyclonedx") ? "cyclonedx" : "spdx"
           Bundler.ui.error("Error: #{input_file} not found. Run 'bundle sbom dump --format=#{file_type} --sbom=#{sbom_type}' first.")
           exit 1
@@ -90,7 +90,7 @@ module Bundler
         rescue JSON::ParserError
           Bundler.ui.error("Error: #{input_file} is not a valid JSON file")
           exit 1
-        rescue StandardError => e
+        rescue => e
           Bundler.ui.error("Error processing #{input_file}: #{e.message}")
           exit 1
         end

data/lib/bundler/sbom/cyclonedx.rb

@@ -31,7 +31,12 @@ module Bundler
           "components" => []
         }
 
+        # Deduplicate specs by name and version
+        seen_gems = Set.new
         lockfile.specs.each do |spec|
+          gem_key = "#{spec.name}:#{spec.version}"
+          next if seen_gems.include?(gem_key)
+          seen_gems.add(gem_key)
           begin
             gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
             licenses = []
@@ -56,7 +61,7 @@ module Bundler
           }
 
           unless licenses.empty?
-            component["licenses"] = licenses.map { |license| { "license" => { "id" => license } } }
+            component["licenses"] = licenses.map { |license| {"license" => {"id" => license}} }
           end
 
           sbom["components"] << component
@@ -74,7 +79,7 @@ module Bundler
         root.add_namespace("http://cyclonedx.org/schema/bom/1.4")
         root.add_attributes({
           "serialNumber" => sbom["serialNumber"],
-          "version" => sbom["version"].to_s,
+          "version" => sbom["version"].to_s
         })
         doc.add_element(root)
 
@@ -184,7 +189,7 @@ module Bundler
           licenses = []
           REXML::XPath.each(comp, "licenses/license") do |license|
             license_id = get_element_text(license, "id")
-            licenses << { "license" => { "id" => license_id } } if license_id
+            licenses << {"license" => {"id" => license_id}} if license_id
           end
 
           component["licenses"] = licenses unless licenses.empty?
@@ -192,12 +197,12 @@ module Bundler
         end
 
         # Convert CycloneDX format to SPDX-like format for compatibility with Reporter
-        converted_sbom = {
+        {
           "packages" => sbom["components"].map do |comp|
             license_string = if comp["licenses"]
               comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
-                            else
-                              "NOASSERTION"
+            else
+              "NOASSERTION"
             end
             {
               "name" => comp["name"],
@@ -206,8 +211,6 @@ module Bundler
             }
           end
         }
-
-        converted_sbom
       end
 
       def self.to_report_format(sbom)
@@ -215,8 +218,8 @@ module Bundler
           "packages" => sbom["components"].map do |comp|
             license_string = if comp["licenses"]
               comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
-                           else
-                             "NOASSERTION"
+            else
+              "NOASSERTION"
             end
             {
               "name" => comp["name"],

data/lib/bundler/sbom/reporter.rb

@@ -16,7 +16,7 @@ module Bundler
 
       def self.sbom_format(sbom)
         return :cyclonedx if sbom["bomFormat"] == "CycloneDX"
-        return :spdx
+        :spdx
       end
 
       def self.display_report(sbom)

data/lib/bundler/sbom/spdx.rb

@@ -21,7 +21,12 @@ module Bundler
           "packages" => []
         }
 
+        # Deduplicate specs by name and version
+        seen_gems = Set.new
         lockfile.specs.each do |spec|
+          gem_key = "#{spec.name}:#{spec.version}"
+          next if seen_gems.include?(gem_key)
+          seen_gems.add(gem_key)
           begin
             gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
             licenses = []

data/lib/bundler/sbom/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Sbom
-    VERSION = "0.1.8"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-sbom
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.2.0
 platform: ruby
 authors:
 - SHIBATA Hiroshi
@@ -78,7 +78,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 test_files: []