gem_guard 0.1.4 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 633376d487060ef6045bec39ca986f4845c8eebf7d2bfeca1ae5b79b7848f5d8
-  data.tar.gz: 20fddc00eb1840578c795ec810c2b25ab189940b2187ed88f3b387bf09e81b3d
+  metadata.gz: '073099f4fd844fee5ffd2b5466fbee6df36a8c5b9d640039efb0cbdb4db89b97'
+  data.tar.gz: 21ba615adb70721d4f9ede82e3a43361a92e72e683c53530504913250ccd7309
 SHA512:
-  metadata.gz: 35354521a0b984df2370f5e9b2f81e9aa0e0d0888d060dd652089f15751536f35ff357b4f8b62affed894c4b8c6879f7c7107e1d08f8a5c077b864e8c0e5dd16
-  data.tar.gz: 1ef4f61f5cdc1046dad193e61e6e6e54cc7bd3cf19fcb21b4130298b192012057c5362c0d7f70ada7391272c59dd0059a05e57c652dc21c4770942e0efb5d588
+  metadata.gz: d1bc314331a645c4b2d9791f41d852620fc7a977fc7eaf90ea927743f297057f4af93c40da2788422c8c468b11fbb1ad4d80d59f16cb4a0c9c063f37ebed809c
+  data.tar.gz: 1dc4f927542ae0983fb73a0d285c66f61c93960f1128bde659a313bbda24a7e6625d41acfdc48fcadeb8600f78bdb2f6de2b052e072a553aa78a937ad841b7dc

data/lib/gem_guard/cli.rb

@@ -22,6 +22,42 @@ module GemGuard
       exit 1 if analysis.has_vulnerabilities?
     end
 
+    desc "sbom", "Generate Software Bill of Materials (SBOM)"
+    option :format, type: :string, default: "spdx", desc: "SBOM format (spdx, cyclone-dx)"
+    option :lockfile, type: :string, default: "Gemfile.lock", desc: "Path to Gemfile.lock"
+    option :output, type: :string, desc: "Output file path (default: stdout)"
+    option :project, type: :string, default: "ruby-project", desc: "Project name for SBOM"
+    def sbom
+      lockfile_path = options[:lockfile]
+
+      unless File.exist?(lockfile_path)
+        puts "Error: #{lockfile_path} not found"
+        exit 1
+      end
+
+      dependencies = Parser.new.parse(lockfile_path)
+      generator = SbomGenerator.new
+
+      sbom_data = case options[:format].downcase
+      when "spdx"
+        generator.generate_spdx(dependencies, options[:project])
+      when "cyclone-dx", "cyclonedx"
+        generator.generate_cyclone_dx(dependencies, options[:project])
+      else
+        puts "Error: Unsupported format '#{options[:format]}'. Use 'spdx' or 'cyclone-dx'"
+        exit 1
+      end
+
+      output_json = JSON.pretty_generate(sbom_data)
+
+      if options[:output]
+        File.write(options[:output], output_json)
+        puts "SBOM written to #{options[:output]}"
+      else
+        puts output_json
+      end
+    end
+
     desc "version", "Show gem_guard version"
     def version
       puts GemGuard::VERSION

data/lib/gem_guard/sbom_generator.rb

@@ -0,0 +1,152 @@
+require "json"
+require "digest"
+require "time"
+
+module GemGuard
+  class SbomGenerator
+    SPDX_VERSION = "SPDX-2.3"
+    CYCLONE_DX_VERSION = "1.5"
+
+    def initialize
+      @document_id = "SPDXRef-DOCUMENT"
+      @creation_time = Time.now.utc.iso8601
+    end
+
+    def generate_spdx(dependencies, project_name = "ruby-project")
+      {
+        "spdxVersion" => SPDX_VERSION,
+        "dataLicense" => "CC0-1.0",
+        "SPDXID" => @document_id,
+        "name" => "#{project_name}-sbom",
+        "documentNamespace" => "https://gem-guard.dev/#{project_name}/#{@creation_time}",
+        "creationInfo" => {
+          "created" => @creation_time,
+          "creators" => ["Tool: gem_guard-#{GemGuard::VERSION}"],
+          "licenseListVersion" => "3.21"
+        },
+        "packages" => build_spdx_packages(dependencies, project_name),
+        "relationships" => build_spdx_relationships(dependencies)
+      }
+    end
+
+    def generate_cyclone_dx(dependencies, project_name = "ruby-project")
+      {
+        "bomFormat" => "CycloneDX",
+        "specVersion" => CYCLONE_DX_VERSION,
+        "serialNumber" => "urn:uuid:#{generate_uuid}",
+        "version" => 1,
+        "metadata" => {
+          "timestamp" => @creation_time,
+          "tools" => [
+            {
+              "vendor" => "GemGuard",
+              "name" => "gem_guard",
+              "version" => GemGuard::VERSION
+            }
+          ],
+          "component" => {
+            "type" => "application",
+            "name" => project_name,
+            "version" => "1.0.0"
+          }
+        },
+        "components" => build_cyclone_dx_components(dependencies)
+      }
+    end
+
+    private
+
+    def build_spdx_packages(dependencies, project_name)
+      packages = []
+
+      # Add root package
+      packages << {
+        "SPDXID" => "SPDXRef-Package-#{sanitize_name(project_name)}",
+        "name" => project_name,
+        "downloadLocation" => "NOASSERTION",
+        "filesAnalyzed" => false,
+        "copyrightText" => "NOASSERTION"
+      }
+
+      # Add dependency packages
+      dependencies.each_with_index do |dep, index|
+        packages << {
+          "SPDXID" => "SPDXRef-Package-#{sanitize_name(dep.name)}",
+          "name" => dep.name,
+          "versionInfo" => dep.version,
+          "downloadLocation" => gem_download_url(dep.name, dep.version),
+          "filesAnalyzed" => false,
+          "homepage" => gem_homepage_url(dep.name),
+          "copyrightText" => "NOASSERTION",
+          "externalRefs" => [
+            {
+              "referenceCategory" => "PACKAGE-MANAGER",
+              "referenceType" => "purl",
+              "referenceLocator" => "pkg:gem/#{dep.name}@#{dep.version}"
+            }
+          ]
+        }
+      end
+
+      packages
+    end
+
+    def build_spdx_relationships(dependencies)
+      relationships = []
+
+      dependencies.each do |dep|
+        relationships << {
+          "spdxElementId" => @document_id,
+          "relationshipType" => "DESCRIBES",
+          "relatedSpdxElement" => "SPDXRef-Package-#{sanitize_name(dep.name)}"
+        }
+      end
+
+      relationships
+    end
+
+    def build_cyclone_dx_components(dependencies)
+      dependencies.map do |dep|
+        {
+          "type" => "library",
+          "bom-ref" => "pkg:gem/#{dep.name}@#{dep.version}",
+          "name" => dep.name,
+          "version" => dep.version,
+          "purl" => "pkg:gem/#{dep.name}@#{dep.version}",
+          "externalReferences" => [
+            {
+              "type" => "distribution",
+              "url" => gem_download_url(dep.name, dep.version)
+            },
+            {
+              "type" => "website",
+              "url" => gem_homepage_url(dep.name)
+            }
+          ]
+        }
+      end
+    end
+
+    def sanitize_name(name)
+      name.gsub(/[^a-zA-Z0-9\-_]/, "-")
+    end
+
+    def gem_download_url(name, version)
+      "https://rubygems.org/downloads/#{name}-#{version}.gem"
+    end
+
+    def gem_homepage_url(name)
+      "https://rubygems.org/gems/#{name}"
+    end
+
+    def generate_uuid
+      # Simple UUID v4 generation
+      bytes = Array.new(16) { rand(256) }
+      bytes[6] = (bytes[6] & 0x0f) | 0x40  # Version 4
+      bytes[8] = (bytes[8] & 0x3f) | 0x80  # Variant bits
+
+      format = "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x"
+      format % bytes
+    end
+  end
+end

data/lib/gem_guard/version.rb

@@ -1,3 +1,3 @@
 module GemGuard
-  VERSION = "0.1.4"
+  VERSION = "0.1.6"
 end

data/lib/gem_guard.rb

@@ -1,9 +1,10 @@
 require_relative "gem_guard/version"
-require_relative "gem_guard/cli"
 require_relative "gem_guard/parser"
 require_relative "gem_guard/vulnerability_fetcher"
 require_relative "gem_guard/analyzer"
 require_relative "gem_guard/reporter"
+require_relative "gem_guard/sbom_generator"
+require_relative "gem_guard/cli"
 
 module GemGuard
   class Error < StandardError; end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gem_guard
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.6
 platform: ruby
 authors:
 - Wilbur Suero
@@ -103,6 +103,7 @@ files:
 - lib/gem_guard/cli.rb
 - lib/gem_guard/parser.rb
 - lib/gem_guard/reporter.rb
+- lib/gem_guard/sbom_generator.rb
 - lib/gem_guard/version.rb
 - lib/gem_guard/vulnerability_fetcher.rb
 - plan.md