bundler-sbom 0.1.8 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 590a4da5b45a12b7d7946aa14626eae531db3220a2441047895db77c078ccf4b
-  data.tar.gz: 525d811c49ee31132eafbccc53e96d7fc4b39e92cd1dac8c704da334120584d4
+  metadata.gz: c2d31deef79ab54416961ff900632cf386f95207f35afd2c2e491d97c53d4c0e
+  data.tar.gz: 6060186d5f3394f12f9c58a2ad1aa4a01b554500f58ef606403536675e506f18
 SHA512:
-  metadata.gz: a4bc5d533a846c9c0786f5fcc17d9ca6f85fe6bbd72719ff016caeebedd2a6e6b68fef6d86c59fced37a5a96a1c601eb5f6fbda00554a67b3e2cb287b1c95a37
-  data.tar.gz: b7e135ea95bbdc7cb93b90864f7f0daf75cda5640f6be982813f6d156d7942bfb4d6c8da8df7f688fb1399afdf9d30d428e75bb4dfcccb4db0ff6fe905d44b9c
+  metadata.gz: bb372a7bf2da186dcdf3a3406f236682b35b3aba690a21f3617a32cd94cebf85a4902e39a755a0e1698ff463a9f37fa8c79a425230ab6d1b68c16d1790dbb476
+  data.tar.gz: aab0fffe6b7c684d8bb07c33040f2f5897c00d9353e5809b665333a714ee6175a36a2eae4ac01d8427c5b273e3911e91fadc8580f486d4dc04db0ec9f6ec337d

data/README.md

@@ -23,6 +23,7 @@ $ bundle sbom dump [options]
 Available options:
 - `-f, --format FORMAT`: Output format (json or xml, default: json)
 - `-s, --sbom FORMAT`: SBOM specification format (spdx or cyclonedx, default: spdx)
+- `--without GROUPS`: Exclude groups (comma or colon separated, e.g., 'development:test' or 'development,test')
 
 Generated files will be named according to the following pattern:
 - SPDX format: `bom.json` or `bom.xml`
@@ -34,6 +35,8 @@ $ bundle sbom dump                           # Generates SPDX format in JSON (bo
 $ bundle sbom dump -f xml                    # Generates SPDX format in XML (bom.xml)
 $ bundle sbom dump -s cyclonedx             # Generates CycloneDX format in JSON (bom-cyclonedx.json)
 $ bundle sbom dump -s cyclonedx -f xml      # Generates CycloneDX format in XML (bom-cyclonedx.xml)
+$ bundle sbom dump --without development    # Excludes development group
+$ bundle sbom dump --without development:test  # Excludes development and test groups
 ```
 
 ### Analyze License Information

data/lib/bundler/sbom/cli.rb

@@ -8,9 +8,11 @@ module Bundler
       desc "dump", "Generate SBOM and save to file"
       method_option :format, type: :string, default: "json", desc: "Output format: json or xml", aliases: "-f"
       method_option :sbom, type: :string, default: "spdx", desc: "SBOM format: spdx or cyclonedx", aliases: "-s"
+      method_option :without, type: :string, desc: "Exclude groups (comma or colon separated, e.g., 'development:test' or 'development,test')"
       def dump
         format = options[:format].downcase
         sbom_format = options[:sbom].downcase
+        without_groups = parse_without_groups(options[:without])
 
         # Validate output format
         unless ["json", "xml"].include?(format)
@@ -25,13 +27,13 @@ module Bundler
         end
 
         # Generate SBOM based on specified format
-        sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format)
+        sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format, without_groups: without_groups)
 
         # Determine file extension based on output format
-        ext = format == "json" ? "json" : "xml"
+        ext = (format == "json") ? "json" : "xml"
 
         # Determine filename prefix based on SBOM format
-        prefix = sbom_format == "spdx" ? "bom" : "bom-cyclonedx"
+        prefix = (sbom_format == "spdx") ? "bom" : "bom-cyclonedx"
         output_file = "#{prefix}.#{ext}"
 
         if format == "json"
@@ -59,19 +61,19 @@ module Bundler
 
         # Determine input file based on format or find default files
         if input_file.nil?
-          if format == "xml" || (format.nil? && File.exist?("bom.xml"))
-            input_file = "bom.xml"
+          input_file = if format == "xml" || (format.nil? && File.exist?("bom.xml"))
+            "bom.xml"
           elsif File.exist?("bom-cyclonedx.json")
-            input_file = "bom-cyclonedx.json"
+            "bom-cyclonedx.json"
           elsif File.exist?("bom-cyclonedx.xml")
-            input_file = "bom-cyclonedx.xml"
+            "bom-cyclonedx.xml"
           else
-            input_file = "bom.json"
+            "bom.json"
           end
         end
 
         unless File.exist?(input_file)
-          file_type = File.extname(input_file) == ".xml" ? "xml" : "json"
+          file_type = (File.extname(input_file) == ".xml") ? "xml" : "json"
           sbom_type = input_file.include?("cyclonedx") ? "cyclonedx" : "spdx"
           Bundler.ui.error("Error: #{input_file} not found. Run 'bundle sbom dump --format=#{file_type} --sbom=#{sbom_type}' first.")
           exit 1
@@ -90,7 +92,7 @@ module Bundler
         rescue JSON::ParserError
           Bundler.ui.error("Error: #{input_file} is not a valid JSON file")
           exit 1
-        rescue StandardError => e
+        rescue => e
           Bundler.ui.error("Error processing #{input_file}: #{e.message}")
           exit 1
         end
@@ -100,6 +102,16 @@ module Bundler
       def self.exit_on_failure?
         true
       end
+
+      private
+
+      def parse_without_groups(without_option)
+        return [] unless without_option
+
+        # Split by comma or colon and clean up whitespace
+        groups = without_option.split(%r{[:,]}).map(&:strip).reject(&:empty?)
+        groups.map(&:to_sym)
+      end
     end
   end
 end

data/lib/bundler/sbom/cyclonedx.rb

@@ -5,7 +5,7 @@ require "rexml/document"
 module Bundler
   module Sbom
     class CycloneDX
-      def self.generate(lockfile, document_name)
+      def self.generate(gems, document_name)
         serial_number = SecureRandom.uuid
         timestamp = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
         sbom = {
@@ -31,7 +31,12 @@ module Bundler
           "components" => []
         }
 
-        lockfile.specs.each do |spec|
+        # Deduplicate specs by name and version
+        seen_gems = Set.new
+        gems.each do |spec|
+          gem_key = "#{spec.name}:#{spec.version}"
+          next if seen_gems.include?(gem_key)
+          seen_gems.add(gem_key)
           begin
             gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
             licenses = []
@@ -56,7 +61,7 @@ module Bundler
           }
 
           unless licenses.empty?
-            component["licenses"] = licenses.map { |license| { "license" => { "id" => license } } }
+            component["licenses"] = licenses.map { |license| {"license" => {"id" => license}} }
           end
 
           sbom["components"] << component
@@ -74,7 +79,7 @@ module Bundler
         root.add_namespace("http://cyclonedx.org/schema/bom/1.4")
         root.add_attributes({
           "serialNumber" => sbom["serialNumber"],
-          "version" => sbom["version"].to_s,
+          "version" => sbom["version"].to_s
         })
         doc.add_element(root)
 
@@ -184,7 +189,7 @@ module Bundler
           licenses = []
           REXML::XPath.each(comp, "licenses/license") do |license|
             license_id = get_element_text(license, "id")
-            licenses << { "license" => { "id" => license_id } } if license_id
+            licenses << {"license" => {"id" => license_id}} if license_id
           end
 
           component["licenses"] = licenses unless licenses.empty?
@@ -192,12 +197,12 @@ module Bundler
         end
 
         # Convert CycloneDX format to SPDX-like format for compatibility with Reporter
-        converted_sbom = {
+        {
           "packages" => sbom["components"].map do |comp|
             license_string = if comp["licenses"]
               comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
-                            else
-                              "NOASSERTION"
+            else
+              "NOASSERTION"
             end
             {
               "name" => comp["name"],
@@ -206,8 +211,6 @@ module Bundler
             }
           end
         }
-
-        converted_sbom
       end
 
       def self.to_report_format(sbom)
@@ -215,8 +218,8 @@ module Bundler
           "packages" => sbom["components"].map do |comp|
             license_string = if comp["licenses"]
               comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
-                           else
-                             "NOASSERTION"
+            else
+              "NOASSERTION"
             end
             {
               "name" => comp["name"],

data/lib/bundler/sbom/generator.rb

@@ -10,7 +10,7 @@ module Bundler
     class GemfileLockNotFoundError < StandardError; end
 
     class Generator
-      def self.generate_sbom(format = "spdx")
+      def self.generate_sbom(format = "spdx", without_groups: [])
         lockfile_path = Bundler.default_lockfile
         if !lockfile_path || !lockfile_path.exist?
           Bundler.ui.error "No Gemfile.lock found. Run `bundle install` first."
@@ -20,11 +20,14 @@ module Bundler
         lockfile = Bundler::LockfileParser.new(lockfile_path.read)
         document_name = File.basename(Dir.pwd)
 
+        # Get gems to include based on groups
+        gems = get_gems_for_groups(lockfile, without_groups)
+
         case format.to_s.downcase
         when "cyclonedx"
-          CycloneDX.generate(lockfile, document_name)
+          CycloneDX.generate(gems, document_name)
         else # default to spdx
-          SPDX.generate(lockfile, document_name)
+          SPDX.generate(gems, document_name)
         end
       end
 
@@ -47,6 +50,44 @@ module Bundler
           SPDX.parse_xml(doc)
         end
       end
+
+      private
+
+      def self.get_gems_for_groups(lockfile, without_groups)
+        # If no groups specified, use all specs
+        if without_groups.empty?
+          return lockfile.specs
+        end
+
+        # Try to get group information from Bundler.definition if available
+        if defined?(Bundler::Definition) && Bundler.respond_to?(:definition)
+          begin
+            definition = Bundler.definition
+            all_groups = definition.groups
+            include_groups = all_groups - without_groups
+
+            # Use specs_for to get all gems (including transitive dependencies) for included groups
+            if definition.respond_to?(:specs_for)
+              definition.specs_for(include_groups)
+            else
+              # Fallback to old method if specs_for is not available
+              included_gems = Set.new
+              include_groups.each do |group|
+                definition.dependencies_for(group).each do |dep|
+                  included_gems.add(dep.name)
+                end
+              end
+              lockfile.specs.select { |spec| included_gems.include?(spec.name) }
+            end
+          rescue => e
+            # Fallback to all specs if there's any issue with Bundler.definition
+            Bundler.ui.warn("Warning: Could not determine group information: #{e.message}")
+            lockfile.specs
+          end
+        else
+          lockfile.specs
+        end
+      end
     end
   end
 end

data/lib/bundler/sbom/reporter.rb

@@ -16,7 +16,7 @@ module Bundler
 
       def self.sbom_format(sbom)
         return :cyclonedx if sbom["bomFormat"] == "CycloneDX"
-        return :spdx
+        :spdx
       end
 
       def self.display_report(sbom)

data/lib/bundler/sbom/spdx.rb

@@ -5,7 +5,7 @@ require "rexml/document"
 module Bundler
   module Sbom
     class SPDX
-      def self.generate(lockfile, document_name)
+      def self.generate(gems, document_name)
         spdx_id = generate_spdx_id
         sbom = {
           "SPDXID" => "SPDXRef-DOCUMENT",
@@ -21,7 +21,12 @@ module Bundler
           "packages" => []
         }
 
-        lockfile.specs.each do |spec|
+        # Deduplicate specs by name and version
+        seen_gems = Set.new
+        gems.each do |spec|
+          gem_key = "#{spec.name}:#{spec.version}"
+          next if seen_gems.include?(gem_key)
+          seen_gems.add(gem_key)
           begin
             gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
             licenses = []

data/lib/bundler/sbom/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Sbom
-    VERSION = "0.1.8"
+    VERSION = "0.3.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-sbom
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.3.0
 platform: ruby
 authors:
 - SHIBATA Hiroshi
@@ -78,7 +78,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 test_files: []