Skip to content
This repository has been archived by the owner on Dec 21, 2024. It is now read-only.

Commit

Permalink
Add SBOM
Browse files Browse the repository at this point in the history 
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
  • Loading branch information
@egibs
egibs committed Jun 9, 2024
1 parent 3234e6d commit 767efff
Show file tree
Hide file tree
Showing 2 changed files with 219 additions and 0 deletions.
3 changes: 3 additions & 0 deletions Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,6 @@ test:

release:
cargo build --all --release

sbom:
syft -o spdx-json . | jq . > sbom.json
216 changes: 216 additions & 0 deletions sbom.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,216 @@
{
"spdxVersion": "SPDX-2.3",
"dataLicense": "CC0-1.0",
"SPDXID": "SPDXRef-DOCUMENT",
"name": ".",
"documentNamespace": "https://anchore.com/syft/dir/cb60b504-69c4-47c2-a395-31781cdf2202",
"creationInfo": {
"licenseListVersion": "3.24",
"creators": [
"Organization: Anchore, Inc",
"Tool: syft-1.5.0"
],
"created": "2024-06-09T01:04:17Z"
},
"packages": [
{
"name": "actions/checkout",
"SPDXID": "SPDXRef-Package-github-action-actions-checkout-842fad84e08d9396",
"versionInfo": "a5ac7e51b41094c92402da3b24376905380afc29",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
"filesAnalyzed": false,
"sourceInfo": "acquired package info from GitHub Actions workflow file or composite action file: /.github/workflows/ci.yml",
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"copyrightText": "NOASSERTION",
"externalRefs": [
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:actions\\/checkout:actions\\/checkout:a5ac7e51b41094c92402da3b24376905380afc29:*:*:*:*:*:*:*"
},
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:github/actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29"
}
]
},
{
"name": "rsd",
"SPDXID": "SPDXRef-Package-rust-crate-rsd-fa2db6addbf12545",
"versionInfo": "0.1.0",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
"filesAnalyzed": false,
"sourceInfo": "acquired package info from rust cargo manifest: /Cargo.lock",
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"copyrightText": "NOASSERTION",
"externalRefs": [
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:rsd:rsd:0.1.0:*:*:*:*:*:*:*"
},
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:cargo/rsd@0.1.0"
}
]
},
{
"name": "step-security/harden-runner",
"SPDXID": "SPDXRef-Package-github-action-step-security-harden-runner-1795139107f2d9bf",
"versionInfo": "17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
"filesAnalyzed": false,
"sourceInfo": "acquired package info from GitHub Actions workflow file or composite action file: /.github/workflows/ci.yml",
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"copyrightText": "NOASSERTION",
"externalRefs": [
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step-security\\/harden-runner:step-security\\/harden-runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step-security\\/harden-runner:step_security\\/harden_runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step_security\\/harden_runner:step-security\\/harden-runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step_security\\/harden_runner:step_security\\/harden_runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step-security\\/harden:step-security\\/harden-runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step-security\\/harden:step_security\\/harden_runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step_security\\/harden:step-security\\/harden-runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step_security\\/harden:step_security\\/harden_runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step:step-security\\/harden-runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "SECURITY",
"referenceType": "cpe23Type",
"referenceLocator": "cpe:2.3:a:step:step_security\\/harden_runner:17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6:*:*:*:*:*:*:*"
},
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:github/step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6"
}
]
},
{
"name": ".",
"SPDXID": "SPDXRef-DocumentRoot-Directory-.",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
"filesAnalyzed": false,
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"primaryPackagePurpose": "FILE"
}
],
"files": [
{
"fileName": "/.github/workflows/ci.yml",
"SPDXID": "SPDXRef-File-.github-workflows-ci.yml-7561d461b00ff11d",
"checksums": [
{
"algorithm": "SHA1",
"checksumValue": "0000000000000000000000000000000000000000"
}
],
"licenseConcluded": "NOASSERTION",
"licenseInfoInFiles": [
"NOASSERTION"
],
"copyrightText": ""
},
{
"fileName": "/Cargo.lock",
"SPDXID": "SPDXRef-File-Cargo.lock-c6bea2c24af05bc1",
"checksums": [
{
"algorithm": "SHA1",
"checksumValue": "0000000000000000000000000000000000000000"
}
],
"licenseConcluded": "NOASSERTION",
"licenseInfoInFiles": [
"NOASSERTION"
],
"copyrightText": ""
}
],
"relationships": [
{
"spdxElementId": "SPDXRef-Package-github-action-step-security-harden-runner-1795139107f2d9bf",
"relatedSpdxElement": "SPDXRef-File-.github-workflows-ci.yml-7561d461b00ff11d",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-Package-github-action-actions-checkout-842fad84e08d9396",
"relatedSpdxElement": "SPDXRef-File-.github-workflows-ci.yml-7561d461b00ff11d",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-Package-rust-crate-rsd-fa2db6addbf12545",
"relatedSpdxElement": "SPDXRef-File-Cargo.lock-c6bea2c24af05bc1",
"relationshipType": "OTHER",
"comment": "evident-by: indicates the package's existence is evident by the given file"
},
{
"spdxElementId": "SPDXRef-DocumentRoot-Directory-.",
"relatedSpdxElement": "SPDXRef-Package-github-action-actions-checkout-842fad84e08d9396",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-DocumentRoot-Directory-.",
"relatedSpdxElement": "SPDXRef-Package-rust-crate-rsd-fa2db6addbf12545",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-DocumentRoot-Directory-.",
"relatedSpdxElement": "SPDXRef-Package-github-action-step-security-harden-runner-1795139107f2d9bf",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-DOCUMENT",
"relatedSpdxElement": "SPDXRef-DocumentRoot-Directory-.",
"relationshipType": "DESCRIBES"
}
]
}

0 comments on commit 767efff

Please sign in to comment.