sbom 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b296a99b1a2ba980aedaa542532fd88bdea816209af3a2be1999a6e4305d0167
-  data.tar.gz: 1e9a7c1e385a4ec311baac0ea055453631d559e76ab4bab67e34cfcf3166f536
+  metadata.gz: 91a2d7468e5e306cb02358a3d4c55d5169cb54e1b022d9ef1cd99f9795713b27
+  data.tar.gz: 6bc9e80848847c7f9cd535acc4b2747f03e6e944982da35c1b5bcfcad9a55c99
 SHA512:
-  metadata.gz: 60e7f56853ad7c7874b3d1b073c06ccbf6a455985ce86b10fba011273d0491a798a6067e866f3d399a2317150128aa035b05dbcae9b53979652fb56e3f924f73
-  data.tar.gz: 4f35f84db7c6d1dfe219e73cc7ecdefd14f701ce5fd091c504318ba7bad4c036b18dc04a17a375ecf6b0ee396a5bbf590c30d4f4d71b96812a375da54d3a84f8
+  metadata.gz: 30b94e777404ed7bf30f3a4f4911079e391a1c51a046175a31a1333b4635a7e4aa16d52d85ff9ccbbc3ecbee29326b89cbd84e78eabb2a4b38a38e42731cddec
+  data.tar.gz: f6ee5ca68429f3bce881b7213e92fab8e030182ecf0cbdffa8ee94799d32cf6ef87c91b9bff589ed99e0792313c826eb8db24355ec7b55637335fc85ea1a2492

data/.ruby-version

@@ -1 +1 @@
-4.0.0
+4.0.5

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 ## [Unreleased]
 
+## [0.5.0] - 2026-06-26
+
+- CycloneDX generator: support `analysis` on vulnerabilities (`state`, `justification`, `response`, `detail`, `firstIssued`, `lastUpdated`)
+- CycloneDX generator: support `pedigree` on components (`patches` with `type`/`diff`/`resolves`, and `notes`)
+
+## [0.4.1] - 2026-01-14
+
+- Include CycloneDX and SPDX schema files in published gem
+
 ## [0.4.0] - 2026-01-08
 
 - Add CycloneDX vulnerabilities array support to generator

data/README.md

@@ -63,6 +63,7 @@ data = {
       ratings: [{ severity: "high", score: 8.1, method: "CVSSv31" }],
       description: "A critical vulnerability",
       affects: [{ ref: "pkg:npm/lodash@4.17.20" }],
+      analysis: { state: "resolved", detail: "Patched by distro" },
       published: "2024-01-15T00:00:00Z",
       updated: "2024-01-20T12:00:00Z"
     }
@@ -131,6 +132,12 @@ package.version = "7.0.0"
 package.license_concluded = "MIT"
 package.add_checksum("SHA256", "abc123...")
 
+# Go modules use base64-encoded hashes in go.sum - convert to hex first:
+require "base64"
+go_hash = "h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4="
+hex = Base64.decode64(go_hash.sub(/^h1:/, "")).unpack1("H*")
+package.add_checksum("SHA256", hex)
+
 # Generate a PURL
 package.generate_purl(type: "gem")
 # => "pkg:gem/rails@7.0.0"

data/lib/sbom/cyclonedx/generator.rb

@@ -207,9 +207,68 @@ module Sbom
           end
         end
 
+        pedigree = generate_pedigree(pkg[:pedigree])
+        component["pedigree"] = pedigree if pedigree
+
         @components << component
       end
 
+      def generate_pedigree(pedigree)
+        return nil unless pedigree
+
+        result = {}
+
+        if pedigree[:patches]&.any?
+          patches = pedigree[:patches].map { |p| generate_pedigree_patch(p) }.compact
+          result["patches"] = patches if patches.any?
+        end
+        result["notes"] = pedigree[:notes] if pedigree[:notes]
+
+        result.empty? ? nil : result
+      end
+
+      def generate_pedigree_patch(patch)
+        # CycloneDX requires `type` on patch objects; drop entries without one
+        # rather than emit `{}` or an empty-string type that fails validation.
+        return nil unless patch && patch[:type]
+
+        result = { "type" => patch[:type].to_s }
+
+        if patch[:diff]
+          diff = {}
+          diff["text"] = patch[:diff][:text] if patch[:diff][:text]
+          diff["url"] = patch[:diff][:url] if patch[:diff][:url]
+          result["diff"] = diff if diff.any?
+        end
+
+        if patch[:resolves]&.any?
+          resolves = patch[:resolves].map { |i| generate_issue(i) }.compact
+          result["resolves"] = resolves if resolves.any?
+        end
+
+        result
+      end
+
+      def generate_issue(issue)
+        # `type` is required on CycloneDX issue objects.
+        return nil unless issue && issue[:type]
+
+        result = { "type" => issue[:type].to_s }
+        result["id"] = issue[:id] if issue[:id]
+        result["name"] = issue[:name] if issue[:name]
+        result["description"] = issue[:description] if issue[:description]
+
+        if issue[:source]
+          source = {}
+          source["name"] = issue[:source][:name] if issue[:source][:name]
+          source["url"] = issue[:source][:url] if issue[:source][:url]
+          result["source"] = source if source.any?
+        end
+
+        result["references"] = Array(issue[:references]) if issue[:references]
+        result
+      end
+
       def generate_dependencies(relationships_data)
         return unless relationships_data&.any?
 
@@ -274,12 +333,29 @@ module Sbom
           end
         end
 
+        analysis = generate_analysis(vuln[:analysis])
+        vulnerability["analysis"] = analysis if analysis
+
         vulnerability["published"] = vuln[:published] if vuln[:published]
         vulnerability["updated"] = vuln[:updated] if vuln[:updated]
 
         @vulnerabilities << vulnerability
       end
 
+      def generate_analysis(analysis)
+        return nil unless analysis
+
+        result = {}
+        result["state"] = analysis[:state] if analysis[:state]
+        result["justification"] = analysis[:justification] if analysis[:justification]
+        result["response"] = Array(analysis[:response]) if analysis[:response]
+        result["detail"] = analysis[:detail] if analysis[:detail]
+        result["firstIssued"] = analysis[:first_issued] if analysis[:first_issued]
+        result["lastUpdated"] = analysis[:last_updated] if analysis[:last_updated]
+
+        result.empty? ? nil : result
+      end
+
       def finalize_output
         @output["components"] = @components if @components.any?
         @output["dependencies"] = @dependencies if @dependencies.any?

data/lib/sbom/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sbom
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end