bundler-sbom 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb720a4c1407de48380f89d81cfb76c76c9aaf72477e06de9d42e2154b278ddf
-  data.tar.gz: '0596c33babc35714c4515f6eb7f018bbabbe22350734650c060f34788a28bb0f'
+  metadata.gz: d5d7fea7d39796fd36fec03e1e5b13695fdccb0cfc6926cfb5a8631d86f94f09
+  data.tar.gz: fe3abc900c32f11af2b0c1f432c9b376042b48a9d8e69c293ccc76b7383a97b0
 SHA512:
-  metadata.gz: a1878c226f0f1dc92967c05dcb52539de886734eed0395a734164c426d14cffcccebf53c13dab7f5113c4497efe44c9b7bcca2898d638a1f84cc88362502f1f8
-  data.tar.gz: 5fb51be53f651ec22422f33fdbb8859842cef43911681ed70d104f9582856f741816491df1a8b67a322122f4eecb21355dabdd9e6d103ab85016f08ea5506a90
+  metadata.gz: 8b79df0b6ab84ce586694fffcf9b9a25e4de2586f85b0430be60f93404df699675e5890936a4ea963f528ed7526b6ffb9e9afe591ee8c8b327952981457654a0
+  data.tar.gz: dec35c52cf5cd36d1b0692a3eb6bb73431f2e07836226af366fd7a8d0c58c964c9577545bf10c01e5178333acbf75a299a63f205bbc3496c557835af5473496b

data/lib/bundler/sbom/cli.rb

@@ -5,28 +5,101 @@ require "bundler/sbom/reporter"
 module Bundler
   module Sbom
     class CLI < Thor
-      desc "dump", "Generate SBOM and save to bom.json"
+      desc "dump", "Generate SBOM and save to file"
+      method_option :format, type: :string, default: "json", desc: "Output format: json or xml", aliases: "-f"
+      method_option :sbom, type: :string, default: "spdx", desc: "SBOM format: spdx or cyclonedx", aliases: "-s"
       def dump
-        sbom = Bundler::Sbom::Generator.generate_sbom
-        File.write("bom.json", JSON.pretty_generate(sbom))
-        Bundler.ui.info("Generated SBOM at bom.json")
-      end
+        format = options[:format].downcase
+        sbom_format = options[:sbom].downcase
 
-      desc "license", "Display license report from existing bom.json"
+        # Validate output format
+        unless ["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported output format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Validate SBOM format
+        unless ["spdx", "cyclonedx"].include?(sbom_format)
+          Bundler.ui.error("Error: Unsupported SBOM format '#{sbom_format}'. Supported formats: spdx, cyclonedx")
+          exit 1
+        end
+
+        # Generate SBOM based on specified format
+        sbom = Bundler::Sbom::Generator.generate_sbom(sbom_format)
+        
+        # Determine file extension based on output format
+        ext = format == "json" ? "json" : "xml"
+        
+        # Determine filename prefix based on SBOM format
+        prefix = sbom_format == "spdx" ? "bom" : "bom-cyclonedx"
+        output_file = "#{prefix}.#{ext}"
+        
+        if format == "json"
+          File.write(output_file, JSON.pretty_generate(sbom))
+        else # xml
+          xml_content = Bundler::Sbom::Generator.convert_to_xml(sbom)
+          File.write(output_file, xml_content)
+        end
+        
+        Bundler.ui.info("Generated #{sbom_format.upcase} SBOM at #{output_file}")
+      end
+      
+      desc "license", "Display license report from SBOM file"
+      method_option :file, type: :string, desc: "Input SBOM file path", aliases: "-f"
+      method_option :format, type: :string, desc: "Input format: json or xml", aliases: "-F"
       def license
-        unless File.exist?("bom.json")
-          Bundler.ui.error("Error: bom.json not found. Run 'bundle sbom dump' first.")
+        format = options[:format]&.downcase
+        input_file = options[:file]
+
+        # Validate format if provided
+        if format && !["json", "xml"].include?(format)
+          Bundler.ui.error("Error: Unsupported format '#{format}'. Supported formats: json, xml")
+          exit 1
+        end
+
+        # Determine input file based on format or find default files
+        if input_file.nil?
+          if format == "xml" || (format.nil? && File.exist?("bom.xml"))
+            input_file = "bom.xml"
+          elsif File.exist?("bom-cyclonedx.json")
+            input_file = "bom-cyclonedx.json"
+          elsif File.exist?("bom-cyclonedx.xml")
+            input_file = "bom-cyclonedx.xml"
+          else
+            input_file = "bom.json"
+          end
+        end
+
+        unless File.exist?(input_file)
+          file_type = File.extname(input_file) == ".xml" ? "xml" : "json"
+          sbom_type = input_file.include?("cyclonedx") ? "cyclonedx" : "spdx"
+          Bundler.ui.error("Error: #{input_file} not found. Run 'bundle sbom dump --format=#{file_type} --sbom=#{sbom_type}' first.")
           exit 1
         end
 
         begin
-          sbom = JSON.parse(File.read("bom.json"))
+          content = File.read(input_file)
+          
+          sbom = if format == "xml" || (!format && File.extname(input_file) == ".xml")
+            Bundler::Sbom::Generator.parse_xml(content)
+          else
+            JSON.parse(content)
+          end
+          
           Bundler::Sbom::Reporter.display_license_report(sbom)
         rescue JSON::ParserError
-          Bundler.ui.error("Error: bom.json is not a valid JSON file")
+          Bundler.ui.error("Error: #{input_file} is not a valid JSON file")
+          exit 1
+        rescue StandardError => e
+          Bundler.ui.error("Error processing #{input_file}: #{e.message}")
           exit 1
         end
       end
+
+      # 適切にエラーで終了することを保証するためのメソッド
+      def self.exit_on_failure?
+        true
+      end
     end
   end
 end

data/lib/bundler/sbom/cyclonedx.rb

@@ -0,0 +1,244 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class CycloneDX
+      def self.generate(lockfile, document_name)
+        serial_number = SecureRandom.uuid
+        timestamp = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => "urn:uuid:#{serial_number}",
+          "version" => 1,
+          "metadata" => {
+            "timestamp" => timestamp,
+            "tools" => [
+              {
+                "vendor" => "Bundler",
+                "name" => "bundle-sbom",
+                "version" => Bundler::Sbom::VERSION
+              }
+            ],
+            "component" => {
+              "type" => "application",
+              "name" => document_name,
+              "version" => "0.0.0" # Default version
+            }
+          },
+          "components" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+          rescue Gem::LoadError
+            licenses = []
+          end
+
+          component = {
+            "type" => "library",
+            "name" => spec.name,
+            "version" => spec.version.to_s,
+            "purl" => "pkg:gem/#{spec.name}@#{spec.version}"
+          }
+
+          unless licenses.empty?
+            component["licenses"] = licenses.map { |license| { "license" => { "id" => license } } }
+          end
+
+          sbom["components"] << component
+        end
+
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+        
+        # Root element
+        root = REXML::Element.new("bom")
+        root.add_namespace("http://cyclonedx.org/schema/bom/1.4")
+        root.add_attributes({
+          "serialNumber" => sbom["serialNumber"],
+          "version" => sbom["version"].to_s,
+        })
+        doc.add_element(root)
+        
+        # Metadata
+        metadata = REXML::Element.new("metadata")
+        root.add_element(metadata)
+        
+        add_element(metadata, "timestamp", sbom["metadata"]["timestamp"])
+        
+        # Tools
+        tools = REXML::Element.new("tools")
+        metadata.add_element(tools)
+        
+        sbom["metadata"]["tools"].each do |tool_data|
+          tool = REXML::Element.new("tool")
+          tools.add_element(tool)
+          
+          add_element(tool, "vendor", tool_data["vendor"])
+          add_element(tool, "name", tool_data["name"])
+          add_element(tool, "version", tool_data["version"].to_s)
+        end
+        
+        # Component (root project)
+        component = REXML::Element.new("component")
+        component.add_attribute("type", sbom["metadata"]["component"]["type"])
+        metadata.add_element(component)
+        
+        add_element(component, "name", sbom["metadata"]["component"]["name"])
+        add_element(component, "version", sbom["metadata"]["component"]["version"])
+        
+        # Components
+        components = REXML::Element.new("components")
+        root.add_element(components)
+        
+        sbom["components"].each do |comp_data|
+          comp = REXML::Element.new("component")
+          comp.add_attribute("type", comp_data["type"])
+          components.add_element(comp)
+          
+          add_element(comp, "name", comp_data["name"])
+          add_element(comp, "version", comp_data["version"])
+          add_element(comp, "purl", comp_data["purl"])
+          
+          # Licenses
+          if comp_data["licenses"] && !comp_data["licenses"].empty?
+            licenses = REXML::Element.new("licenses")
+            comp.add_element(licenses)
+            
+            comp_data["licenses"].each do |license_data|
+              license = REXML::Element.new("license")
+              licenses.add_element(license)
+              
+              if license_data["license"]["id"]
+                add_element(license, "id", license_data["license"]["id"])
+              end
+            end
+          end
+        end
+        
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+        
+        sbom = {
+          "bomFormat" => "CycloneDX",
+          "specVersion" => "1.4",
+          "serialNumber" => root.attributes["serialNumber"],
+          "version" => root.attributes["version"].to_i,
+          "metadata" => {
+            "timestamp" => get_element_text(root, "metadata/timestamp"),
+            "tools" => [],
+            "component" => {
+              "type" => REXML::XPath.first(root, "metadata/component").attributes["type"],
+              "name" => get_element_text(root, "metadata/component/name"),
+              "version" => get_element_text(root, "metadata/component/version")
+            }
+          },
+          "components" => []
+        }
+        
+        # Collect tools
+        REXML::XPath.each(root, "metadata/tools/tool") do |tool|
+          tool_data = {
+            "vendor" => get_element_text(tool, "vendor"),
+            "name" => get_element_text(tool, "name"),
+            "version" => get_element_text(tool, "version")
+          }
+          sbom["metadata"]["tools"] << tool_data
+        end
+        
+        # Collect components
+        REXML::XPath.each(root, "components/component") do |comp|
+          component = {
+            "type" => comp.attributes["type"],
+            "name" => get_element_text(comp, "name"),
+            "version" => get_element_text(comp, "version"),
+            "purl" => get_element_text(comp, "purl")
+          }
+          
+          # Collect licenses
+          licenses = []
+          REXML::XPath.each(comp, "licenses/license") do |license|
+            license_id = get_element_text(license, "id")
+            licenses << { "license" => { "id" => license_id } } if license_id
+          end
+          
+          component["licenses"] = licenses unless licenses.empty?
+          sbom["components"] << component
+        end
+
+        # Convert CycloneDX format to SPDX-like format for compatibility with Reporter
+        converted_sbom = {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+                              comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                            else
+                              "NOASSERTION"
+                            end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+        
+        converted_sbom
+      end
+
+      def self.to_report_format(sbom)
+        {
+          "packages" => sbom["components"].map do |comp|
+            license_string = if comp["licenses"]
+                             comp["licenses"].map { |l| l["license"]["id"] }.join(", ")
+                           else
+                             "NOASSERTION"
+                           end
+            {
+              "name" => comp["name"],
+              "versionInfo" => comp["version"],
+              "licenseDeclared" => license_string
+            }
+          end
+        }
+      end
+
+      private
+      
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+      
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/generator.rb

@@ -1,12 +1,16 @@
 require "bundler"
 require "securerandom"
+require "json"
+require "rexml/document"
+require "bundler/sbom/spdx"
+require "bundler/sbom/cyclonedx"
 
 module Bundler
   module Sbom
     class GemfileLockNotFoundError < StandardError; end
 
     class Generator
-      def self.generate_sbom
+      def self.generate_sbom(format = "spdx")
         lockfile_path = Bundler.default_lockfile
         if !lockfile_path || !lockfile_path.exist?
           Bundler.ui.error "No Gemfile.lock found. Run `bundle install` first."
@@ -15,66 +19,33 @@ module Bundler
 
         lockfile = Bundler::LockfileParser.new(lockfile_path.read)
         document_name = File.basename(Dir.pwd)
-        spdx_id = SecureRandom.uuid
 
-        sbom = {
-          "SPDXID" => "SPDXRef-DOCUMENT",
-          "spdxVersion" => "SPDX-2.2",
-          "creationInfo" => {
-            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
-            "creators" => ["Tool: bundle-sbom"],
-            "licenseListVersion" => "3.17"
-          },
-          "name" => document_name,
-          "dataLicense" => "CC0-1.0",
-          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
-          "packages" => []
-        }
-
-        lockfile.specs.each do |spec|
-          begin
-            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
-            licenses = []
-            if gemspec
-              if gemspec.license && !gemspec.license.empty?
-                licenses << gemspec.license
-              end
-
-              if gemspec.licenses && !gemspec.licenses.empty?
-                licenses.concat(gemspec.licenses)
-              end
-
-              licenses.uniq!
-            end
-
-            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
-          rescue Gem::LoadError
-            license_string = "NOASSERTION"
-          end
+        case format.to_s.downcase
+        when "cyclonedx"
+          CycloneDX.generate(lockfile, document_name)
+        else # default to spdx
+          SPDX.generate(lockfile, document_name)
+        end
+      end
 
-          package = {
-            "SPDXID" => "SPDXRef-Package-#{spec.name}",
-            "name" => spec.name,
-            "versionInfo" => spec.version.to_s,
-            "downloadLocation" => "NOASSERTION",
-            "filesAnalyzed" => false,
-            "licenseConcluded" => license_string,
-            "licenseDeclared" => license_string,
-            "copyrightText" => "NOASSERTION",
-            "supplier" => "NOASSERTION",
-            "externalRefs" => [
-              {
-                "referenceCategory" => "PACKAGE_MANAGER",
-                "referenceType" => "purl",
-                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
-              }
-            ]
-          }
-          sbom["packages"] << package
+      def self.convert_to_xml(sbom)
+        if sbom["bomFormat"] == "CycloneDX"
+          CycloneDX.to_xml(sbom)
+        else
+          SPDX.to_xml(sbom)
         end
+      end
 
-        sbom["documentDescribes"] = sbom["packages"].map { |p| p["SPDXID"] }
-        sbom
+      def self.parse_xml(xml_content)
+        doc = REXML::Document.new(xml_content)
+        root = doc.root
+        
+        # Determine if it's CycloneDX or SPDX
+        if root.name == "bom" && root.namespace.include?("cyclonedx.org")
+          CycloneDX.parse_xml(doc)
+        else
+          SPDX.parse_xml(doc)
+        end
       end
     end
   end

data/lib/bundler/sbom/reporter.rb

@@ -2,6 +2,24 @@ module Bundler
   module Sbom
     class Reporter
       def self.display_license_report(sbom)
+        # フォーマットに応じて適切な形式に変換
+        sbom = if sbom_format(sbom) == :cyclonedx
+          CycloneDX.to_report_format(sbom)
+        else
+          SPDX.to_report_format(sbom)
+        end
+        
+        display_report(sbom)
+      end
+
+      private
+
+      def self.sbom_format(sbom)
+        return :cyclonedx if sbom["bomFormat"] == "CycloneDX"
+        return :spdx
+      end
+
+      def self.display_report(sbom)
         license_count = analyze_licenses(sbom)
         sorted_licenses = license_count.sort_by { |_, count| -count }
 
@@ -30,8 +48,6 @@ module Bundler
         end
       end
 
-      private
-
       def self.analyze_licenses(sbom)
         license_count = Hash.new(0)
         sbom["packages"].each do |package|

data/lib/bundler/sbom/spdx.rb

@@ -0,0 +1,220 @@
+require "bundler"
+require "securerandom"
+require "rexml/document"
+
+module Bundler
+  module Sbom
+    class SPDX
+      def self.generate(lockfile, document_name)
+        spdx_id = SecureRandom.uuid
+        sbom = {
+          "SPDXID" => "SPDXRef-DOCUMENT",
+          "spdxVersion" => "SPDX-2.3",
+          "creationInfo" => {
+            "created" => Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "creators" => ["Tool: bundle-sbom"],
+            "licenseListVersion" => "3.20"
+          },
+          "name" => document_name,
+          "dataLicense" => "CC0-1.0",
+          "documentNamespace" => "https://spdx.org/spdxdocs/#{document_name}-#{spdx_id}",
+          "packages" => []
+        }
+
+        lockfile.specs.each do |spec|
+          begin
+            gemspec = Gem::Specification.find_by_name(spec.name, spec.version)
+            licenses = []
+            if gemspec
+              if gemspec.license && !gemspec.license.empty?
+                licenses << gemspec.license
+              end
+              if gemspec.licenses && !gemspec.licenses.empty?
+                licenses.concat(gemspec.licenses)
+              end
+              licenses.uniq!
+            end
+            license_string = licenses.empty? ? "NOASSERTION" : licenses.join(", ")
+          rescue Gem::LoadError
+            license_string = "NOASSERTION"
+          end
+
+          package = {
+            "SPDXID" => "SPDXRef-Package-#{spec.name}",
+            "name" => spec.name,
+            "versionInfo" => spec.version.to_s,
+            "downloadLocation" => "NOASSERTION",
+            "filesAnalyzed" => false,
+            "licenseConcluded" => license_string,
+            "licenseDeclared" => license_string,
+            "copyrightText" => "NOASSERTION",
+            "supplier" => "NOASSERTION",
+            "externalRefs" => [
+              {
+                "referenceCategory" => "PACKAGE_MANAGER",
+                "referenceType" => "purl",
+                "referenceLocator" => "pkg:gem/#{spec.name}@#{spec.version}"
+              }
+            ]
+          }
+          sbom["packages"] << package
+        end
+
+        sbom["documentDescribes"] = sbom["packages"].map { |p| p["SPDXID"] }
+        sbom
+      end
+
+      def self.to_xml(sbom)
+        doc = REXML::Document.new
+        doc << REXML::XMLDecl.new("1.0", "UTF-8")
+        
+        # Root element
+        root = REXML::Element.new("SpdxDocument")
+        root.add_namespace("https://spdx.org/spdxdocs/")
+        doc.add_element(root)
+        
+        # Document info
+        add_element(root, "SPDXID", sbom["SPDXID"])
+        add_element(root, "spdxVersion", sbom["spdxVersion"])
+        add_element(root, "name", sbom["name"])
+        add_element(root, "dataLicense", sbom["dataLicense"])
+        add_element(root, "documentNamespace", sbom["documentNamespace"])
+        
+        # Creation info
+        creation_info = REXML::Element.new("creationInfo")
+        root.add_element(creation_info)
+        add_element(creation_info, "created", sbom["creationInfo"]["created"])
+        add_element(creation_info, "licenseListVersion", sbom["creationInfo"]["licenseListVersion"])
+        
+        sbom["creationInfo"]["creators"].each do |creator|
+          add_element(creation_info, "creator", creator)
+        end
+        
+        # Describes
+        sbom["documentDescribes"].each do |describes|
+          add_element(root, "documentDescribes", describes)
+        end
+        
+        # Packages
+        sbom["packages"].each do |pkg|
+          package = REXML::Element.new("package")
+          root.add_element(package)
+          
+          add_element(package, "SPDXID", pkg["SPDXID"])
+          add_element(package, "name", pkg["name"])
+          add_element(package, "versionInfo", pkg["versionInfo"])
+          add_element(package, "downloadLocation", pkg["downloadLocation"])
+          add_element(package, "filesAnalyzed", pkg["filesAnalyzed"].to_s)
+          add_element(package, "licenseConcluded", pkg["licenseConcluded"])
+          add_element(package, "licenseDeclared", pkg["licenseDeclared"])
+          add_element(package, "copyrightText", pkg["copyrightText"])
+          add_element(package, "supplier", pkg["supplier"])
+          
+          # External references
+          if pkg["externalRefs"]
+            pkg["externalRefs"].each do |ref|
+              ext_ref = REXML::Element.new("externalRef")
+              package.add_element(ext_ref)
+              
+              add_element(ext_ref, "referenceCategory", ref["referenceCategory"])
+              add_element(ext_ref, "referenceType", ref["referenceType"])
+              add_element(ext_ref, "referenceLocator", ref["referenceLocator"])
+            end
+          end
+        end
+        
+        formatter = REXML::Formatters::Pretty.new(2)
+        formatter.compact = true
+        output = ""
+        formatter.write(doc, output)
+        output.sub(%r{<\?xml version='1\.0' encoding='UTF-8'\?>}, '<?xml version="1.0" encoding="UTF-8"?>')
+      end
+
+      def self.parse_xml(doc)
+        root = doc.root
+        
+        sbom = {
+          "SPDXID" => get_element_text(root, "SPDXID"),
+          "spdxVersion" => get_element_text(root, "spdxVersion"),
+          "name" => get_element_text(root, "name"),
+          "dataLicense" => get_element_text(root, "dataLicense"),
+          "documentNamespace" => get_element_text(root, "documentNamespace"),
+          "creationInfo" => {
+            "created" => get_element_text(root, "creationInfo/created"),
+            "licenseListVersion" => get_element_text(root, "creationInfo/licenseListVersion"),
+            "creators" => []
+          },
+          "packages" => [],
+          "documentDescribes" => []
+        }
+        
+        # Collect creators
+        REXML::XPath.each(root, "creationInfo/creator") do |creator|
+          sbom["creationInfo"]["creators"] << creator.text
+        end
+        
+        # Collect documentDescribes
+        REXML::XPath.each(root, "documentDescribes") do |describes|
+          sbom["documentDescribes"] << describes.text
+        end
+        
+        # Collect packages
+        REXML::XPath.each(root, "package") do |pkg_element|
+          package = {
+            "SPDXID" => get_element_text(pkg_element, "SPDXID"),
+            "name" => get_element_text(pkg_element, "name"),
+            "versionInfo" => get_element_text(pkg_element, "versionInfo"),
+            "downloadLocation" => get_element_text(pkg_element, "downloadLocation"),
+            "filesAnalyzed" => get_element_text(pkg_element, "filesAnalyzed") == "true",
+            "licenseConcluded" => get_element_text(pkg_element, "licenseConcluded"),
+            "licenseDeclared" => get_element_text(pkg_element, "licenseDeclared"),
+            "copyrightText" => get_element_text(pkg_element, "copyrightText"),
+            "supplier" => get_element_text(pkg_element, "supplier"),
+            "externalRefs" => []
+          }
+          
+          # Collect external references
+          REXML::XPath.each(pkg_element, "externalRef") do |ref_element|
+            ref = {
+              "referenceCategory" => get_element_text(ref_element, "referenceCategory"),
+              "referenceType" => get_element_text(ref_element, "referenceType"),
+              "referenceLocator" => get_element_text(ref_element, "referenceLocator")
+            }
+            package["externalRefs"] << ref
+          end
+          
+          sbom["packages"] << package
+        end
+        
+        sbom
+      end
+
+      def self.to_report_format(sbom)
+        # SPDXフォーマットは既にレポート形式と互換性があるため、
+        # packagesセクションだけを抽出して返す
+        {
+          "packages" => sbom["packages"].map do |pkg|
+            {
+              "name" => pkg["name"],
+              "versionInfo" => pkg["versionInfo"],
+              "licenseDeclared" => pkg["licenseDeclared"]
+            }
+          end
+        }
+      end
+
+      private
+      
+      def self.add_element(parent, name, value)
+        element = REXML::Element.new(name)
+        element.text = value
+        parent.add_element(element)
+      end
+      
+      def self.get_element_text(element, xpath)
+        result = REXML::XPath.first(element, xpath)
+        result ? result.text : nil
+      end
+    end
+  end
+end

data/lib/bundler/sbom/version.rb

@@ -1,5 +1,5 @@
 module Bundler
   module Sbom
-    VERSION = "0.1.6"
+    VERSION = "0.1.7"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bundler-sbom
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - SHIBATA Hiroshi
 bindir: exe
 cert_chain: []
-date: 2025-03-05 00:00:00.000000000 Z
+date: 2025-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -23,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rexml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Generate SPDX SBOM(Software Bill of Materials) files with Bundler
 email:
 - hsbt@ruby-lang.org
@@ -36,8 +50,10 @@ files:
 - Rakefile
 - lib/bundler/sbom.rb
 - lib/bundler/sbom/cli.rb
+- lib/bundler/sbom/cyclonedx.rb
 - lib/bundler/sbom/generator.rb
 - lib/bundler/sbom/reporter.rb
+- lib/bundler/sbom/spdx.rb
 - lib/bundler/sbom/version.rb
 - plugins.rb
 homepage: https://github.com/hsbt/bundler-sbom
@@ -55,7 +71,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="