Add sbom generation tooling (#2232) by Lukasz-Juranek · Pull Request #106 · eclipse-score/tooling

Lukasz-Juranek · 2026-01-31T09:15:06Z

This PR adds SBOM Bazel rules for SCORE modules. For setup details see the SBOM_Readme.md.

Generated SBOM files (reference_integration — sbom_kyron_module, 2026-02-27)

Built with bazel build //:sbom_kyron_module after all compliance fixes.

sbom_kyron_module.spdx.json — SPDX 2.3 (96 KB, 93 packages)
sbom_kyron_module.cdx.json — CycloneDX 1.6 (75 KB, 93 components)

Both files pass sbomgenerator.com/tools/validator with zero errors and zero warnings.

Coverage (93 packages)

Metric	Count	%
With license	71	76%
With checksum (SHA-256)	74	80%
With description	93	100%
With supplier	91	98%

Missing licenses: 22 packages — iceoryx2-*-qnx8 platform forks (not in Eclipse Foundation / ClearlyDefined) + a handful of other crates not yet indexed.

Generated file formats

Output file	Format	Notes
`.spdx.json`	SPDX 2.3	`checksums` SHA-256 for crates from lockfile; boolean operators uppercase-normalized (e.g. `Apache-2.0 OR MIT`)
`.cdx.json`	CycloneDX 1.6	Schema `https://cyclonedx.org/schema/bom-1.6.schema.json\`; compound expressions use `expression` field
`_crates_metadata.json`	Internal cache	Generated by `dash-license-scan` + crates.io API when `auto_crates_cache = True`
`_cdxgen.cdx.json`	CycloneDX (cdxgen)	C++ dependency scan output when `auto_cdxgen = True`

CISA 2025 element coverage (both formats)

Element	SPDX 2.3	CycloneDX 1.6
Component Name	✅	✅
Component Version	✅	✅
Software Identifiers (PURL)	✅ `pkg:cargo/`, `pkg:generic/`, `pkg:github/`	✅
Component Hash (SHA-256)	✅ `checksums` field	✅ `hashes` field
License	✅ Rust via dash-license-scan	✅
Supplier	✅	✅
Description	✅ Rust via crates.io API	✅
Dependency Relationship	✅ `DEPENDS_ON`	✅ `dependencies` graph
SBOM Author	✅ `creators`	✅ `metadata.authors`
Tool Name	✅ `creators`	✅ `metadata.tools`
Timestamp	✅	✅
Generation Context	—	✅ `metadata.lifecycles`

Compliance fixes (commits `e443267` → `9acc306`)

PURL type: `pkg:bazel/` → `pkg:generic/` (unregistered PURL type)
SPDX checksums: `checksums` field now emitted for packages with known SHA-256
CycloneDX `$schema`: `http://` → `https://`
crates.io `externalReferences`: distribution URL emitted for all lockfile-derived crate components
BCR known licenses: `BCR_KNOWN_LICENSES` + `apply_known_licenses()` — auto-fills license/supplier for `boost.*`, `abseil-cpp`, `zlib`, etc.
License operator case: `_normalize_spdx_license()` in both formatters — `Apache-2.0 or MIT` → `Apache-2.0 OR MIT`; compound expressions correctly routed to CycloneDX `expression` field

Dependabot / GitHub Dependency Graph integration (`f2cc71f`)

The generated SPDX 2.3 SBOMs can feed GitHub Dependabot via the Dependency Submission API.

New: `sbom/scripts/spdx_to_github_snapshot.py`

Converts SPDX 2.3 → GitHub Dependency Submission snapshot (handles SPDX 2.3 — GitHub's official action only supports 2.2):

Extracts all packages with PURLs (`pkg:cargo`, `pkg:generic`, `pkg:github`, etc.)
Test run on `sbom_kyron_module.spdx.json`: 103 packages → 102 snapshot packages

New: `.github/workflows/sbom_dependency_submission.yml`

Reusable workflow: builds SBOM → converts `*.spdx.json` → POSTs to `dependency-graph/snapshots`.

Prerequisite: enable Dependency Graph in repo Settings → Code security → Dependency graph.

jobs:
  sbom:
    uses: eclipse-score/tooling/.github/workflows/sbom_dependency_submission.yml@main
    with:
      sbom_target: '//:sbom_all'
      release_tag: ${{ github.ref_name }}
    permissions:
      contents: write

Dash-license-scan results (288 crates from `MODULE.bazel.lock`)

Metric	Count	%
With license	261	90.6%
With description	288	100%
With supplier	285	99.0%
With checksum	269	93.4%

27 crates lack license data: 19 `iceoryx2-*-qnx8` platform forks + 8 others (`tonic`, `ipc-channel`, `argh`, etc.) not yet indexed by Eclipse Foundation / ClearlyDefined.

Test results: 79 passed

+| [@cyclonedx/cdxgen](https://github.com/CycloneDX/cdxgen) | C++ dependency scanner and license discovery tool | C++ metadata extraction when `auto_cdxgen = True` |
+| [Node.js / npm](https://nodejs.org) | Runtime for cdxgen | C++ metadata extraction when `auto_cdxgen = True` |
+
+### Five-Phase Architecture


Which of these actually depend on bazel? Can we use this tool without bazel?

@AlexanderLanin thx for review.

cyclonedx/cdxgen you can use without bazel, both NPM and cdxgen are currently required on system to be installed on system they are not deployed via bazel.

Bazel is only needed to collect dependencies that are needed to build the target,
This data is then hold in sbom_aspect then tool is matching data from this structure to data from cdxgen and bazel lockfile

But if you have all data that is needed in dash-license-scan then we should use this as source of data, not cdxgen and bazel lockfile

Maybe lets make some short sync on this just ping me on slack when you will have time

For think that we can't use only the dash-licensese-scan but we can extract license data from it

Field crates_metadata.json provides dash-license-scan provides

version Yes Yes (from Cargo.lock parse)

license Yes (from crates.io API) Yes (from Eclipse/ClearlyDefined)

checksum (SHA-256) Yes No

purl Yes (pkg:cargo/name@ver) No (uses crate/cratesio/-/ format)

repository Yes (from crates.io API) No

AlexanderLanin · 2026-02-09T19:56:41Z

sbom/scripts/generate_crates_metadata_cache.py

+#!/usr/bin/env python3
+"""Generate crates.io metadata cache for SBOM generation.
+
+This script parses Cargo.lock files and/or MODULE.bazel.lock files,


cargo.lock parsing has also been implemented in dash-license-scan. Probably needs alignment.

AlexanderLanin · 2026-02-09T19:59:24Z

sbom/scripts/generate_crates_metadata_cache.py

+        lockfile_path: Path to MODULE.bazel.lock file
+
+    Returns:
+        Dict mapping crate name to {version, checksum, source}


how do you know which version to use? Thats the main reason I have not implemented bazel lockfile parsing in dash-license-scan, since there is no way to know which version is actually relevant?!

no i was not aware of this problem

AlexanderLanin · 2026-02-09T20:00:39Z

sbom/tests/test_cyclonedx_formatter.py

@@ -0,0 +1,142 @@
+"""Tests for CycloneDX 1.6 formatter."""
+
+import unittest


would you consider pytest? I don't know if its better or worse. But we use pytest everywhere.

ok i will change framework

AlexanderLanin · 2026-02-09T20:01:41Z

sbom/crates_licenses_common.json

@@ -0,0 +1,78 @@
+{
+  "serde": {"license": "MIT OR Apache-2.0"},


note that different versions can have different licenses

this file is not used ,

The actual license data now comes from crates_metadata.json (generated by the cache script from crates.io API + MODULE.bazel.lock).

i need to clean this trash

AlexanderLanin · 2026-02-09T20:02:45Z

sbom/defs.bzl

+    targets, traversing their transitive dependencies and generating output
+    in SPDX 2.3 and/or CycloneDX 1.6 format.
+
+    License metadata is collected automatically:


this is where dash-license-scan could somehow fit it. It collects verified license information.

i will check it if we can match get license field from dash output makes sense.

AlexanderLanin · 2026-02-09T20:26:36Z

sbom/SBOM_Readme.md

+# bazel_dep module (version from module graph)
+sbom_ext.license(
+    name = "googletest",
+    license = "BSD-3-Clause",


we should use dash-licene-scan and not write hand collected license infos

Lukasz-Juranek · 2026-02-10T21:50:28Z

@AlexanderLanin i've updated SBOM tooling to get license from dash you can take a look at some generated files

sbom_communication.cdx.json
sbom_kyron_module.cdx.json
sbom_baselibs.cdx.json

Two things to confirm

Dash only supports rust right ? I could not get cpp licenses
License ids like this are expected right ?

 "id": "Apache-2.0 AND MIT AND Apache-2.0 AND MIT"

evinoth1206 · 2026-02-11T17:23:50Z

Thanks for the work on the SBOM generation! I reviewed the CycloneDX output and have some feedback:

Must fix:

Invalid license format for compound SPDX expressions: When a component has multiple licenses combined with AND/OR, the current format uses "license": { "id": "Apache-2.0 AND MIT" }, which fails schema validation. The id field only accepts a single SPDX identifier. Compound expressions must use the expression field instead:
// ❌ Current (invalid):
"licenses": [{ "license": { "id": "Apache-2.0 AND MIT" } }]

// ✅ Correct:
"licenses": [{ "expression": "Apache-2.0 AND MIT" }]

Missing description field on all components. Every component should have at least a short description for SBOM usability

Nice to have (can be addressed in a follow-up):

Missing cpe identifiers for OSS components. Adding CPE entries (e.g. cpe:2.3:a:google:flatbuffers:25.2.10:::::::*) would improve vulnerability matching against the NVD.
Flat dependency graph. Currently all dependsOn arrays are empty except for the root component, which lists everything as a direct dependency. Ideally the graph should reflect actual transitive relationships (e.g. serde-derive depends on syn, quote, proc-macro2).

Lukasz-Juranek · 2026-02-12T19:31:16Z

Thanks for the work on the SBOM generation! I reviewed the CycloneDX output and have some feedback:

Must fix:

Invalid license format for compound SPDX expressions: When a component has multiple licenses combined with AND/OR, the current format uses "license": { "id": "Apache-2.0 AND MIT" }, which fails schema validation. The id field only accepts a single SPDX identifier. Compound expressions must use the expression field instead:
// ❌ Current (invalid):
"licenses": [{ "license": { "id": "Apache-2.0 AND MIT" } }]

// ✅ Correct: "licenses": [{ "expression": "Apache-2.0 AND MIT" }]

Missing description field on all components. Every component should have at least a short description for SBOM usability

Nice to have (can be addressed in a follow-up):

Missing cpe identifiers for OSS components. Adding CPE entries (e.g. cpe:2.3:a:google:flatbuffers:25.2.10:::::::*) would improve vulnerability matching against the NVD.

Flat dependency graph. Currently all dependsOn arrays are empty except for the root component, which lists everything as a direct dependency. Ideally the graph should reflect actual transitive relationships (e.g. serde-derive depends on syn, quote, proc-macro2).

Updated PR fixed licenses you can check this i've validated it using https://tools.spdx.org/app/ntia_checker/ and it passed

sbom_kyron_module.cdx.json
sbom_kyron_module.spdx.json

masc2023 · 2026-02-13T13:16:49Z

@Lukasz-Juranek , you can also check here, both files above seems valid
https://sbomgenerator.com/tools/validator

pahmann · 2026-02-27T10:33:25Z

sbom/internal/generator/spdx_formatter.py

+    config: dict[str, Any],
+    timestamp: str,
+) -> dict[str, Any]:
+    """Generate SPDX 2.3 JSON document.


Latest version of SPDX is 3.0 at least.

if we are sure that tooling that we want to use for venerability scan and some other stuff is supporting SPDX 3.0 then fine i can generate SPDX 3.0

Lukasz-Juranek · 2026-02-27T12:19:28Z

Attaching regenerated SBOM files (post license-normalization fix):

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-project-automation bot added this to INF - Infrastructure Community Jan 31, 2026

github-project-automation bot moved this to Draft in INF - Infrastructure Community Jan 31, 2026

This was referenced Jan 31, 2026

Add sbom targets (#2232) eclipse-score/reference_integration#83

Draft

Add sbom data for baselibs (#2232) eclipse-score/baselibs#93

Closed

Improvement: SBOM eclipse-score/score#2232

Open

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch from ffca1f1 to e308870 Compare February 7, 2026 09:37

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch 2 times, most recently from cad2c59 to 8e9cb95 Compare February 8, 2026 14:04

Lukasz-Juranek mentioned this pull request Feb 9, 2026

Add sbom generation tooling for rust and cpp(#2232) eclipse-score/score-crates#24

Draft

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch 4 times, most recently from 9382341 to c8d2a39 Compare February 9, 2026 19:51

AlexanderLanin reviewed Feb 9, 2026

View reviewed changes

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch 2 times, most recently from 3c0af62 to 35c92b1 Compare February 10, 2026 17:04

dcalavrezo-qorix mentioned this pull request Feb 11, 2026

Gap content eclipse-score/score#2019

Open

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch from 7b00264 to 3d5b273 Compare February 12, 2026 19:21

Lukasz-Juranek marked this pull request as ready for review February 27, 2026 10:33

pahmann reviewed Feb 27, 2026

View reviewed changes

PandaeDo requested review from CryptoNutcase, PandaeDo and masc2023 February 27, 2026 10:33

PandaeDo requested review from MaximilianSoerenPollak, aschemmel-tech and sunildevda February 27, 2026 10:33

Add sbom generation tooling (#2232)

1aca6d2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Lukasz-Juranek force-pushed the feat/issue-2232-sbom-init branch from 1f779eb to 1aca6d2 Compare February 27, 2026 18:57

Field	crates_metadata.json provides	dash-license-scan provides
version	Yes	Yes (from Cargo.lock parse)
license	Yes (from crates.io API)	Yes (from Eclipse/ClearlyDefined)
checksum (SHA-256)	Yes	No
purl	Yes (pkg:cargo/name@ver)	No (uses crate/cratesio/-/ format)
repository	Yes (from crates.io API)	No

		@@ -0,0 +1,142 @@
		"""Tests for CycloneDX 1.6 formatter."""

		import unittest

Conversation

Lukasz-Juranek commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Generated SBOM files (reference_integration — sbom_kyron_module, 2026-02-27)

Coverage (93 packages)

Generated file formats

CISA 2025 element coverage (both formats)

Compliance fixes (commits e443267 → 9acc306)

Dependabot / GitHub Dependency Graph integration (f2cc71f)

New: `sbom/scripts/spdx_to_github_snapshot.py`

New: `.github/workflows/sbom_dependency_submission.yml`

Dash-license-scan results (288 crates from `MODULE.bazel.lock`)

Test results: 79 passed

Related

Uh oh!

AlexanderLanin commented Feb 2, 2026

Uh oh!

Lukasz-Juranek commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lukasz-Juranek commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lukasz-Juranek Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lukasz-Juranek Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lukasz-Juranek commented Feb 10, 2026

Uh oh!

evinoth1206 commented Feb 11, 2026

Uh oh!

Lukasz-Juranek commented Feb 12, 2026

Uh oh!

masc2023 commented Feb 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lukasz-Juranek commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Lukasz-Juranek commented Jan 31, 2026 •

edited

Loading

Compliance fixes (commits `e443267` → `9acc306`)

Dependabot / GitHub Dependency Graph integration (`f2cc71f`)

Lukasz-Juranek commented Feb 3, 2026 •

edited

Loading

Lukasz-Juranek commented Feb 7, 2026 •

edited

Loading

Lukasz-Juranek Feb 10, 2026 •

edited

Loading

Lukasz-Juranek Feb 10, 2026 •

edited

Loading