Skip to content

feat(report): Implement SBOM SPDX-JSON format reporter #2339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shino merged 14 commits into from
Oct 25, 2025
Merged

feat(report): Implement SBOM SPDX-JSON format reporter #2339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
1d8ec30
add spdx report
ReiPenguin Oct 15, 2025
ef8ca3f
fix scannedCves
ReiPenguin Oct 16, 2025
1c19067
fix
ReiPenguin Oct 16, 2025
43b6ff1
add sort
ReiPenguin Oct 16, 2025
83bc5ab
add report command
ReiPenguin Oct 16, 2025
f4000c4
fix comment
ReiPenguin Oct 16, 2025
36ada28
fix review comment
ReiPenguin Oct 17, 2025
ba24cdf
use cmp.Or
ReiPenguin Oct 21, 2025
186f98c
relationShip -> relationship / range
ReiPenguin Oct 21, 2025
9b1f896
fix noneValue
ReiPenguin Oct 21, 2025
ea3c857
documentNamespace
ReiPenguin Oct 21, 2025
1f38c14
fix reference return
ReiPenguin Oct 21, 2025
907b8a0
fix
ReiPenguin Oct 23, 2025
f7c9810
fix
ReiPenguin Oct 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ require (
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
github.com/samber/lo v1.51.0
github.com/sirupsen/logrus v1.9.3
github.com/spdx/tools-golang v0.5.5
github.com/spf13/cobra v1.10.1
github.com/vulsio/go-cti v0.3.2
github.com/vulsio/go-cve-dictionary v0.14.0
Expand Down Expand Up @@ -100,6 +101,7 @@ require (
github.com/agext/levenshtein v1.2.3 // indirect
github.com/agnivade/levenshtein v1.2.1 // indirect
github.com/alecthomas/chroma v0.10.0 // indirect
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
github.com/andybalholm/cascadia v1.3.3 // indirect
github.com/apparentlymart/go-cidr v1.1.0 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
Expand Down
3 changes: 3 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1601,6 +1601,7 @@ github.com/sosedoff/gitkit v0.4.0/go.mod h1:V3EpGZ0nvCBhXerPsbDeqtyReNb48cwP9Ktk
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
Expand Down Expand Up @@ -1634,6 +1635,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
Expand Down
11 changes: 11 additions & 0 deletions reporter/localfile.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ type LocalFileWriter struct {
FormatList bool
FormatCycloneDXJSON bool
FormatCycloneDXXML bool
FormatSPDXJSON bool
Gzip bool
}

Expand Down Expand Up @@ -118,6 +119,16 @@ func (w LocalFileWriter) Write(rs ...models.ScanResult) (err error) {
}
}

if w.FormatSPDXJSON {
bs, err := sbom.SerializeSPDX(sbom.ToSPDX(r, ""))
if err != nil {
return xerrors.Errorf("Failed to generate SPDX JSON. err: %w", err)
}
p := fmt.Sprintf("%s_spdx.json", path)
if err := w.writeFile(p, bs, 0600); err != nil {
return xerrors.Errorf("Failed to write SPDX JSON. path: %s, err: %w", p, err)
}
}
}
return nil
}
Expand Down
Loading
Loading