sbom 0.1.0

data/lib/sbom/data/relationship.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Sbom
+  module Data
+    class Relationship
+      attr_accessor :source, :target, :relationship_type,
+                    :source_id, :target_id,
+                    :source_type, :target_type
+
+      def initialize(source: nil, target: nil, relationship_type: nil)
+        @source = source
+        @target = target
+        @relationship_type = relationship_type&.strip
+        @source_id = nil
+        @target_id = nil
+        @source_type = nil
+        @target_type = nil
+      end
+
+      def reset!
+        @source = nil
+        @target = nil
+        @relationship_type = nil
+        @source_id = nil
+        @target_id = nil
+        @source_type = nil
+        @target_type = nil
+      end
+
+      def to_h
+        {
+          source: @source,
+          target: @target,
+          type: @relationship_type,
+          source_id: @source_id,
+          target_id: @target_id,
+          source_type: @source_type,
+          target_type: @target_type
+        }.compact
+      end
+    end
+  end
+end

data/lib/sbom/data/sbom.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module Sbom
+  module Data
+    class Sbom
+      attr_accessor :sbom_type, :version, :uuid, :bom_version
+
+      def initialize(sbom_type: :auto)
+        @sbom_type = sbom_type
+        @document = nil
+        @files = {}
+        @packages = {}
+        @relationships = []
+        @licenses = []
+        @annotations = []
+        @properties = []
+      end
+
+      def document
+        @document
+      end
+
+      def document=(doc)
+        @document = doc.is_a?(Hash) ? doc : doc&.to_h
+      end
+
+      def add_document(doc)
+        @document = doc.is_a?(Hash) ? doc : doc&.to_h
+      end
+
+      def files
+        @files.values
+      end
+
+      def add_file(file)
+        data = file.is_a?(Hash) ? file : file.to_h
+        key = data[:name]
+        @files[key] = data if key
+      end
+
+      def add_files(files_hash)
+        @files.merge!(files_hash) if files_hash.is_a?(Hash) && files_hash.any?
+      end
+
+      def packages
+        @packages.values
+      end
+
+      def add_package(package)
+        data = package.is_a?(Hash) ? package : package.to_h
+        key = [data[:name], data[:version]]
+        @packages[key] = data if data[:name]
+      end
+
+      def add_packages(packages_hash)
+        @packages.merge!(packages_hash) if packages_hash.is_a?(Hash) && packages_hash.any?
+      end
+
+      def relationships
+        @relationships
+      end
+
+      def add_relationship(relationship)
+        data = relationship.is_a?(Hash) ? relationship : relationship.to_h
+        @relationships << data
+      end
+
+      def add_relationships(relationships_list)
+        @relationships.concat(relationships_list) if relationships_list.is_a?(Array)
+      end
+
+      def licenses
+        @licenses
+      end
+
+      def add_license(license)
+        @licenses << license
+      end
+
+      def add_licenses(licenses_list)
+        @licenses.concat(licenses_list) if licenses_list.is_a?(Array)
+      end
+
+      def annotations
+        @annotations
+      end
+
+      def add_annotation(annotation)
+        @annotations << annotation
+      end
+
+      def add_annotations(annotations_list)
+        @annotations.concat(annotations_list) if annotations_list.is_a?(Array)
+      end
+
+      def add_property(name, value)
+        @properties << [name.strip, value]
+      end
+
+      def properties
+        @properties
+      end
+
+      def to_h
+        result = {
+          type: @sbom_type,
+          version: @version,
+          uuid: @uuid,
+          bom_version: @bom_version
+        }
+
+        result[:document] = @document if @document
+        result[:files] = @files if @files.any?
+        result[:packages] = @packages if @packages.any?
+        result[:relationships] = @relationships if @relationships.any?
+        result[:licenses] = @licenses if @licenses.any?
+        result[:annotations] = @annotations if @annotations.any?
+        result[:properties] = @properties if @properties.any?
+
+        result.compact
+      end
+    end
+  end
+end

data/lib/sbom/error.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Sbom
+  class Error < StandardError; end
+
+  class ParserError < Error; end
+
+  class GeneratorError < Error; end
+
+  class ValidatorError < Error; end
+
+  class UnsupportedFormatError < Error; end
+end

data/lib/sbom/generator.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Sbom
+  class Generator
+    VALID_FORMATS = %i[tag json yaml].freeze
+    VALID_TYPES = %i[spdx cyclonedx].freeze
+
+    def initialize(sbom_type: :spdx, format: :json, application: "sbom", version: Sbom::VERSION)
+      @sbom_type = validate_type(sbom_type)
+      @format = validate_format(format, @sbom_type)
+      @application = application
+      @version = version
+      @generator = create_generator
+    end
+
+    def generate(project_name, sbom_data)
+      @generator.generate(project_name, sbom_data)
+    end
+
+    def output
+      @generator.output
+    end
+
+    def to_h
+      @generator.to_h
+    end
+
+    def sbom_type
+      @sbom_type
+    end
+
+    def format
+      @format
+    end
+
+    def self.generate(project_name, sbom_data, sbom_type: :spdx, format: :json)
+      gen = new(sbom_type: sbom_type, format: format)
+      gen.generate(project_name, sbom_data)
+      gen
+    end
+
+    private
+
+    def validate_type(type)
+      type_sym = type.to_s.downcase.to_sym
+      return type_sym if VALID_TYPES.include?(type_sym)
+
+      :spdx
+    end
+
+    def validate_format(format, sbom_type)
+      format_sym = format.to_s.downcase.to_sym
+
+      if sbom_type == :cyclonedx
+        return :json
+      end
+
+      return format_sym if VALID_FORMATS.include?(format_sym)
+
+      :json
+    end
+
+    def create_generator
+      if @sbom_type == :cyclonedx
+        Cyclonedx::Generator.new(
+          format: @format,
+          application: @application,
+          version: @version
+        )
+      else
+        Spdx::Generator.new(
+          format: @format,
+          application: @application,
+          version: @version
+        )
+      end
+    end
+  end
+end