From d604a07225c5c82b942cd3374cc113ad676a2519 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0tetiar?= Date: Tue, 24 Oct 2023 08:27:13 +0000 Subject: build: add CycloneDX SBOM JSON support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CycloneDX is an open source standard developed by the OWASP foundation. It supports a wide range of development ecosystems, a comprehensive set of use cases, and focuses on automation, ease of adoption, and progressive enhancement of SBOMs (Software Bill Of Materials) throughout build pipelines. So lets add support for CycloneDX SBOM for packages and images manifests. Signed-off-by: Petr Štetiar --- package/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'package/Makefile') diff --git a/package/Makefile b/package/Makefile index 4b8df7f484..8e72d4ec72 100644 --- a/package/Makefile +++ b/package/Makefile @@ -106,6 +106,14 @@ ifdef CONFIG_SIGNED_PACKAGES $(STAGING_DIR_HOST)/bin/usign -S -m Packages -s $(BUILD_KEY); \ ); done endif +ifdef CONFIG_JSON_CYCLONEDX_SBOM + @echo Creating CycloneDX package SBOMs... + @for d in $(PACKAGE_SUBDIRS); do ( \ + [ -d $$d ] && \ + cd $$d || continue; \ + $(SCRIPT_DIR)/package-metadata.pl pkgcyclonedxsbom Packages.manifest > Packages.bom.cdx.json || true; \ + ); done +endif $(curdir)/flags-install:= -j1 -- cgit v1.2.3