Dev

.cmake-format

@@ -37,6 +37,7 @@ parse:
  DOWNLOAD_LOCATION: 1
  RELATIONSHIP: 1
  SPDXID: 1
+ SUPPLIER: 1
  sbom_add:
  kwargs:
  FILENAME: 1

CHANGELOG.rst

@@ -20,6 +20,18 @@ The format is based on `Keep a Changelog`_, and this project adheres to `Semanti
 `Unreleased`_
 -------------
 
+Added
+`````
+
+...
+
+.. _Unreleased: https:/DEMCON/cmake-sbom/compare/v1.0.0...HEAD
+
+
+
+`1.0.0`_ - 2023-09-27
+---------------------
+
 Initial version.
 
 Added
@@ -28,4 +40,4 @@ Added
 - Git version extraction.
 - SPDX SBOM generation from CMake.
 
-.. _Unreleased: https:/DEMCON/cmake-sbom
+.. _1.0.0: https:/DEMCON/cmake-sbom/releases/tag/v1.0.0

README.rst

@@ -247,6 +247,7 @@ Add something to the SBOM.
  [LICENSE <string>]
  [RELATIONSHIP <string>]
  [SPDXID <id>]
+ [SUPPLIER <name>]
  [VERSION <version>]
  )
 
@@ -267,6 +268,9 @@ Add something to the SBOM.
  License of the package.
  Defaults to ``NOASSERTION`` when not specified.
 
+``SUPPLIER``
+ Package supplier, which can be ``Person: name (email)``, or ``Organization: name (email)``.
+
 ``VERSION``
  Version of the package.
 

cmake/sbom.cmake

@@ -175,12 +175,14 @@ function(sbom_generate)
  install(
  CODE "
  message(STATUS \"Installing: ${SBOM_GENERATE_OUTPUT}\")
- file(WRITE \"${SBOM_GENERATE_OUTPUT}\" \"\")
+ file(WRITE \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\" \"\")
  "
  )
 
+ file(MAKE_DIRECTORY ${PROJECT_BINARY_DIR}/sbom)
+
  if("${SBOM_GENERATE_INPUT}" STREQUAL "")
- set(_f "${CMAKE_CURRENT_BINARY_DIR}/SPDXRef-DOCUMENT.cmake")
+ set(_f "${CMAKE_CURRENT_BINARY_DIR}/SPDXRef-DOCUMENT.spdx.in")
 
  get_filename_component(doc_name "${SBOM_GENERATE_OUTPUT}" NAME_WE)
 
@@ -206,6 +208,7 @@ PackageDownloadLocation: NOASSERTION
 PackageLicenseConcluded: NOASSERTION
 PackageLicenseDeclared: NOASSERTION
 PackageCopyrightText: NOASSERTION
+PackageSupplier: Organization: Anonymous
 FilesAnalyzed: false
 PackageSummary: <text>The compiler as identified by CMake, running on ${CMAKE_HOST_SYSTEM_NAME} (${CMAKE_HOST_SYSTEM_PROCESSOR})</text>
 PrimaryPackagePurpose: APPLICATION
@@ -225,6 +228,7 @@ PackageLicenseDeclared: ${SBOM_GENERATE_LICENSE}
 PackageCopyrightText: ${SBOM_GENERATE_COPYRIGHT}
 PackageHomePage: ${SBOM_GENERATE_SUPPLIER_URL}
 PackageComment: <text>Built by CMake ${CMAKE_VERSION} with ${CMAKE_BUILD_TYPE} configuration for ${CMAKE_SYSTEM_NAME} (${CMAKE_SYSTEM_PROCESSOR})</text>
+PackageVerificationCode: \${SBOM_VERIFICATION_CODE}
 BuiltDate: ${NOW_UTC}
 Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-${SBOM_GENERATE_PROJECT}
 "
@@ -233,7 +237,7 @@ Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-${SBOM_GENERATE_PROJECT}
  install(
  CODE "
  file(READ \"${_f}\" _f_contents)
- file(APPEND \"${SBOM_GENERATE_OUTPUT}\" \"\${_f_contents}\")
+ file(APPEND \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\" \"\${_f_contents}\")
  "
  )
 
@@ -254,7 +258,7 @@ Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-${SBOM_GENERATE_PROJECT}
  install(
  CODE "
  file(READ \"${_f_in_gen}\" _f_contents)
- file(APPEND \"${SBOM_GENERATE_OUTPUT}\" \"\${_f_contents}\")
+ file(APPEND \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\" \"\${_f_contents}\")
  "
  )
  endforeach()
@@ -265,11 +269,12 @@ Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-${SBOM_GENERATE_PROJECT}
  )
  endif()
 
+ install(CODE "set(SBOM_VERIFICATION_CODES)")
+
  set_property(GLOBAL PROPERTY sbom_filename "${SBOM_GENERATE_OUTPUT}")
  set_property(GLOBAL PROPERTY sbom_project "${SBOM_GENERATE_PROJECT}")
  set_property(GLOBAL PROPERTY sbom_spdxids 0)
 
- file(MAKE_DIRECTORY ${PROJECT_BINARY_DIR}/sbom)
  file(WRITE ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt "")
 endfunction()
 
@@ -287,6 +292,13 @@ function(sbom_finalize)
  file(
  WRITE ${PROJECT_BINARY_DIR}/sbom/verify.cmake
  "
+ message(STATUS \"Finalizing: ${_sbom}\")
+ list(SORT SBOM_VERIFICATION_CODES)
+ string(REPLACE \";\" \"\" SBOM_VERIFICATION_CODES \"\${SBOM_VERIFICATION_CODES}\")
+ file(WRITE \"${PROJECT_BINARY_DIR}/sbom/verification.txt\" \"\${SBOM_VERIFICATION_CODES}\")
+ file(SHA1 \"${PROJECT_BINARY_DIR}/sbom/verification.txt\" SBOM_VERIFICATION_CODE)
+ configure_file(\"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\" \"${_sbom}\")
+
  message(STATUS \"Verifying: ${_sbom}\")
  execute_process(
  COMMAND ${Python3_EXECUTABLE} -m spdx_tools.spdx.clitools.pyspdxtools
@@ -365,7 +377,8 @@ function(sbom_file)
  endif()
  else()
  file(SHA1 ${CMAKE_INSTALL_PREFIX}/${SBOM_FILE_FILENAME} _sha1)
- file(APPEND \"${_sbom}\"
+ list(APPEND SBOM_VERIFICATION_CODES \${_sha1})
+ file(APPEND \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\"
 \"
 FileName: ./${SBOM_FILE_FILENAME}
 SPDXID: ${SBOM_FILE_SPDXID}
@@ -467,7 +480,8 @@ function(sbom_directory)
  set(_count 0)
  foreach(_f IN LISTS _files)
  file(SHA1 \"${CMAKE_INSTALL_PREFIX}/\${_f}\" _sha1)
- file(APPEND \"${_sbom}\"
+ list(APPEND SBOM_VERIFICATION_CODES \${_sha1})
+ file(APPEND \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\"
 \"
 FileName: ./\${_f}
 SPDXID: ${SBOM_DIRECTORY_SPDXID}-\${_count}
@@ -495,7 +509,7 @@ endfunction()
 # Append a package (without files) to the SBOM. Use this after calling sbom_generate().
 function(sbom_package)
  set(options)
- set(oneValueArgs PACKAGE VERSION LICENSE DOWNLOAD_LOCATION RELATIONSHIP SPDXID)
+ set(oneValueArgs PACKAGE VERSION LICENSE DOWNLOAD_LOCATION RELATIONSHIP SPDXID SUPPLIER)
  set(multiValueArgs EXTREF)
  cmake_parse_arguments(
  SBOM_PACKAGE "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN}
@@ -521,10 +535,12 @@ function(sbom_package)
 
  set(_fields)
 
- if(NOT "${SBOM_PACKAGE_VERSION}" STREQUAL "")
- set(_fields "${_fields}
-PackageVersion: ${SBOM_PACKAGE_VERSION}"
- )
+ if("${SBOM_PACKAGE_VERSION}" STREQUAL "")
+ set(SBOM_PACKAGE_VERSION "unknown")
+ endif()
+
+ if("${SBOM_PACKAGE_SUPPLIER}" STREQUAL "")
+ set(SBOM_PACKAGE_SUPPLIER "Person: Anonymous")
  endif()
 
  if(NOT "${SBOM_PACKAGE_LICENSE}" STREQUAL "")
@@ -565,14 +581,16 @@ ExternalRef: ${_ref}"
  OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/${SBOM_PACKAGE_SPDXID}.cmake
  CONTENT
  "
- file(APPEND \"${_sbom}\"
+ file(APPEND \"${PROJECT_BINARY_DIR}/sbom/sbom.spdx.in\"
 \"
 PackageName: ${SBOM_PACKAGE_PACKAGE}
 SPDXID: ${SBOM_PACKAGE_SPDXID}
 ExternalRef: SECURITY cpe23Type ${SBOM_CPE}
 PackageDownloadLocation: ${SBOM_PACKAGE_DOWNLOAD_LOCATION}
 PackageLicenseDeclared: NOASSERTION
 PackageCopyrightText: NOASSERTION
+PackageVersion: ${SBOM_PACKAGE_VERSION}
+PackageSupplier: ${SBOM_PACKAGE_SUPPLIER}
 FilesAnalyzed: false${_fields}
 Relationship: ${SBOM_PACKAGE_RELATIONSHIP}
 Relationship: ${SBOM_PACKAGE_SPDXID} CONTAINS NOASSERTION

cmake/version.cmake

@@ -193,7 +193,7 @@ function(version_generate)
  string(REGEX REPLACE "^([0-9]+)\\.([0-9]+)\\.([0-9]+)([-+].*)?$" "\\3"
  GIT_VERSION_PATCH "${GIT_VERSION}"
  )
- string(REGEX REPLACE "^([0-9]+)\\.([0-9]+)\\.([0-9]+)([-+].*)?$" "\\4"
+ string(REGEX REPLACE "^([0-9]+)\\.([0-9]+)\\.([0-9]+)(([-+].*)?)$" "\\4"
  GIT_VERSION_SUFFIX "${GIT_VERSION}"
  )
  else()