sbom 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '080bc0e7e22560d9779d7dc7914a6fd6d440dee48508da1db84d1c9d03fd3c5b'
-  data.tar.gz: 007f185f1ebc3a95bac42ca6419155e9a269bb0b98e1be5a478b6eab5f43e06c
+  metadata.gz: b296a99b1a2ba980aedaa542532fd88bdea816209af3a2be1999a6e4305d0167
+  data.tar.gz: 1e9a7c1e385a4ec311baac0ea055453631d559e76ab4bab67e34cfcf3166f536
 SHA512:
-  metadata.gz: e67dca4dfb55a94d8f55093938773389206f69d5765748323bed4672da6182d76e6d503bf96bda90bde6c721cabac9b21f061714de005fba6c4d4d25e874e4d5
-  data.tar.gz: fa270f7dad9214c3a15c1b1bad23d3982955bd262f4bdb332b6bf73f464ac9e846761f8ef01e4fb34058cbbe3253d80ee1f2c04460fa0e385754364acf75e1e9
+  metadata.gz: 60e7f56853ad7c7874b3d1b073c06ccbf6a455985ce86b10fba011273d0491a798a6067e866f3d399a2317150128aa035b05dbcae9b53979652fb56e3f924f73
+  data.tar.gz: 4f35f84db7c6d1dfe219e73cc7ecdefd14f701ce5fd091c504318ba7bad4c036b18dc04a17a375ecf6b0ee396a5bbf590c30d4f4d71b96812a375da54d3a84f8

data/.ruby-version

@@ -0,0 +1 @@
+4.0.0

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [0.4.0] - 2026-01-08
+
+- Add CycloneDX vulnerabilities array support to generator
+
 ## [0.3.0] - 2025-12-23
 
 - Add `merge` command to CLI for combining multiple SBOMs into one

data/README.md

@@ -52,6 +52,24 @@ puts generator.output
 generator = Sbom::Generator.new(sbom_type: :cyclonedx)
 generator.generate("MyProject", sbom_data)
 File.write("sbom.cdx.json", generator.output)
+
+# Generate CycloneDX with vulnerabilities
+data = {
+  packages: packages_data,
+  vulnerabilities: [
+    {
+      id: "CVE-2024-1234",
+      source: { name: "OSV", url: "https://osv.dev" },
+      ratings: [{ severity: "high", score: 8.1, method: "CVSSv31" }],
+      description: "A critical vulnerability",
+      affects: [{ ref: "pkg:npm/lodash@4.17.20" }],
+      published: "2024-01-15T00:00:00Z",
+      updated: "2024-01-20T12:00:00Z"
+    }
+  ]
+}
+generator = Sbom::Generator.new(sbom_type: :cyclonedx)
+generator.generate("MyProject", data)
 ```
 
 ### Validating SBOMs

data/lib/sbom/cyclonedx/generator.rb

@@ -24,6 +24,7 @@ module Sbom
         @output = {}
         @components = []
         @dependencies = []
+        @vulnerabilities = []
         @element_refs = {}
       end
 
@@ -41,6 +42,7 @@ module Sbom
         generate_document_header(project_name, component_data, uuid, bom_version)
         generate_components(data[:packages])
         generate_dependencies(data[:relationships])
+        generate_vulnerabilities(data[:vulnerabilities])
 
         finalize_output
       end
@@ -234,9 +236,54 @@ module Sbom
         end
       end
 
+      def generate_vulnerabilities(vulnerabilities_data)
+        return unless vulnerabilities_data&.any?
+
+        vulnerabilities_data.each do |vuln|
+          generate_vulnerability(vuln)
+        end
+      end
+
+      def generate_vulnerability(vuln)
+        return unless vuln[:id]
+
+        vulnerability = { "id" => vuln[:id] }
+
+        if vuln[:source]
+          source = {}
+          source["name"] = vuln[:source][:name] if vuln[:source][:name]
+          source["url"] = vuln[:source][:url] if vuln[:source][:url]
+          vulnerability["source"] = source if source.any?
+        end
+
+        if vuln[:ratings]&.any?
+          vulnerability["ratings"] = vuln[:ratings].map do |rating|
+            r = {}
+            r["severity"] = rating[:severity] if rating[:severity]
+            r["score"] = rating[:score] if rating[:score]
+            r["method"] = rating[:method] if rating[:method]
+            r
+          end.reject(&:empty?)
+        end
+
+        vulnerability["description"] = vuln[:description] if vuln[:description]
+
+        if vuln[:affects]&.any?
+          vulnerability["affects"] = vuln[:affects].map do |affect|
+            { "ref" => affect[:ref] }
+          end
+        end
+
+        vulnerability["published"] = vuln[:published] if vuln[:published]
+        vulnerability["updated"] = vuln[:updated] if vuln[:updated]
+
+        @vulnerabilities << vulnerability
+      end
+
       def finalize_output
         @output["components"] = @components if @components.any?
         @output["dependencies"] = @dependencies if @dependencies.any?
+        @output["vulnerabilities"] = @vulnerabilities if @vulnerabilities.any?
       end
 
       def version_at_least?(version)

data/lib/sbom/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sbom
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sbom
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Andrew Nesbitt
@@ -61,6 +61,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitmodules"
+- ".ruby-version"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
@@ -113,7 +114,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.1
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Parse, generate, and validate Software Bill of Materials (SBOM)
 test_files: []