129 lines
4.0 KiB
Bash
Executable File
129 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUT_DIR="${1:-"$ROOT_DIR/dist/release-v0.2"}"
|
|
SBOM_DIR="$OUT_DIR/sbom"
|
|
VERSION="release-readiness-v0.2"
|
|
|
|
mkdir -p "$SBOM_DIR"
|
|
|
|
cd "$ROOT_DIR"
|
|
|
|
COMMIT="$(git rev-parse HEAD)"
|
|
GENERATED_AT="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
|
|
|
|
cargo metadata --manifest-path adk-rust/Cargo.toml --format-version 1 \
|
|
> "$SBOM_DIR/cargo-metadata-v0.2.json"
|
|
|
|
(cd adk-rust && cargo tree --workspace) \
|
|
> "$SBOM_DIR/cargo-tree-v0.2.txt"
|
|
|
|
find aw-server clickhouse-1c detmir-mcp scripts -maxdepth 4 -type f \
|
|
\( -name 'requirements.txt' -o -name 'pyproject.toml' -o -name 'setup.py' \) \
|
|
-print -exec sha256sum {} \; \
|
|
> "$SBOM_DIR/python-inputs-v0.2.txt"
|
|
|
|
python3 - "$SBOM_DIR/cargo-metadata-v0.2.json" "$SBOM_DIR/cyclonedx-rust-v0.2.json" "$SBOM_DIR/spdx-rust-v0.2.json" "$COMMIT" "$GENERATED_AT" <<'PY'
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
metadata_path, cyclonedx_path, spdx_path, commit, generated_at = sys.argv[1:]
|
|
metadata = json.loads(Path(metadata_path).read_text(encoding="utf-8"))
|
|
packages = sorted(metadata.get("packages", []), key=lambda item: (item.get("name", ""), item.get("version", "")))
|
|
|
|
components = []
|
|
spdx_packages = []
|
|
for package in packages:
|
|
name = package.get("name") or "unknown"
|
|
version = package.get("version") or "0"
|
|
license_value = package.get("license") or "NOASSERTION"
|
|
components.append({
|
|
"type": "library",
|
|
"bom-ref": f"pkg:cargo/{name}@{version}",
|
|
"name": name,
|
|
"version": version,
|
|
"licenses": [{"expression": license_value}] if license_value != "NOASSERTION" else [],
|
|
"purl": f"pkg:cargo/{name}@{version}",
|
|
})
|
|
spdx_packages.append({
|
|
"name": name,
|
|
"SPDXID": f"SPDXRef-Package-{name.replace('_', '-').replace('.', '-')}-{version.replace('.', '-')}",
|
|
"versionInfo": version,
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": False,
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": license_value,
|
|
"copyrightText": "NOASSERTION",
|
|
})
|
|
|
|
cyclonedx = {
|
|
"bomFormat": "CycloneDX",
|
|
"specVersion": "1.5",
|
|
"serialNumber": f"urn:uuid:00000000-0000-4000-8000-{commit[:12].ljust(12, '0')}",
|
|
"version": 1,
|
|
"metadata": {
|
|
"timestamp": generated_at,
|
|
"component": {
|
|
"type": "application",
|
|
"name": "AWatch-rus",
|
|
"version": "release-readiness-v0.2",
|
|
"bom-ref": "pkg:generic/detmir-awatch-rus@release-readiness-v0.2",
|
|
},
|
|
"properties": [
|
|
{"name": "git.commit", "value": commit},
|
|
{"name": "scope", "value": "Rust workspace dependencies"},
|
|
],
|
|
},
|
|
"components": components,
|
|
}
|
|
|
|
spdx = {
|
|
"spdxVersion": "SPDX-2.3",
|
|
"dataLicense": "CC0-1.0",
|
|
"SPDXID": "SPDXRef-DOCUMENT",
|
|
"name": "AWatch-rus release-readiness-v0.2 Rust SBOM",
|
|
"documentNamespace": f"https://github.com/igor04091968/AWatch-rus/sbom/{commit}",
|
|
"creationInfo": {
|
|
"created": generated_at,
|
|
"creators": ["Tool: scripts/generate_release_sbom_v0_2.sh"],
|
|
},
|
|
"packages": spdx_packages,
|
|
}
|
|
|
|
Path(cyclonedx_path).write_text(json.dumps(cyclonedx, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
|
|
Path(spdx_path).write_text(json.dumps(spdx, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
|
|
PY
|
|
|
|
cat > "$OUT_DIR/RELEASE_ASSETS_MANIFEST-v0.2.json" <<JSON
|
|
{
|
|
"release": "$VERSION",
|
|
"generated_at_utc": "$GENERATED_AT",
|
|
"git_commit": "$COMMIT",
|
|
"assets": [
|
|
"sbom/cyclonedx-rust-v0.2.json",
|
|
"sbom/spdx-rust-v0.2.json",
|
|
"sbom/cargo-metadata-v0.2.json",
|
|
"sbom/cargo-tree-v0.2.txt",
|
|
"sbom/python-inputs-v0.2.txt"
|
|
]
|
|
}
|
|
JSON
|
|
|
|
(
|
|
cd "$OUT_DIR"
|
|
find . -type f ! -name 'SHA256SUMS-v0.2.txt' ! -name '*.sig' -print \
|
|
| sort \
|
|
| sed 's#^\./##' \
|
|
| xargs -r sha256sum > SHA256SUMS-v0.2.txt
|
|
)
|
|
|
|
cat <<EOF
|
|
release SBOM v0.2 generated
|
|
out_dir=$OUT_DIR
|
|
commit=$COMMIT
|
|
assets:
|
|
$(sed 's/^/ /' "$OUT_DIR/SHA256SUMS-v0.2.txt")
|
|
EOF
|