qt6-migration-pipeline/external-dependencies/scripts/generate-sbom.sh

#!/bin/bash
set -euo pipefail

# SBOM Generation Script for External Dependencies
# Generates CycloneDX SBOM and SLSA v1.0 provenance for build artifacts

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_NAME="${1:-unknown}"
PACKAGE_VERSION="${2:-unknown}"
OUTPUT_DIR="${3:-${SCRIPT_DIR}/sbom}"

mkdir -p "${OUTPUT_DIR}"

echo "Generating SBOM for ${PACKAGE_NAME} v${PACKAGE_VERSION}..."

# Generate CycloneDX SBOM
generate_cyclonedx_sbom() {
    local sbom_file="${OUTPUT_DIR}/${PACKAGE_NAME}-sbom.json"
    
    cat > "${sbom_file}" << EOF
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")",
    "tools": [
      {
        "vendor": "jenkins",
        "name": "sbom-generator",
        "version": "1.0.0"
      }
    ],
    "component": {
      "type": "library",
      "name": "${PACKAGE_NAME}",
      "version": "${PACKAGE_VERSION}",
      "purl": "pkg:generic/${PACKAGE_NAME}@${PACKAGE_VERSION}",
      "bom-ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "${PACKAGE_NAME}",
      "version": "${PACKAGE_VERSION}",
      "licenses": [
        {
          "license": {
            "name": "See LICENSE file"
          }
        }
      ],
      "purl": "pkg:generic/${PACKAGE_NAME}@${PACKAGE_VERSION}",
      "bom-ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}"
    }
  ],
  "dependencies": [
    {
      "ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}",
      "dependsOn": []
    }
  ]
}
EOF
    
    echo "Generated CycloneDX SBOM: ${sbom_file}"
}

# Generate SLSA v1.0 provenance
generate_slsa_provenance() {
    local provenance_file="${OUTPUT_DIR}/${PACKAGE_NAME}-provenance.json"
    local git_url="${GIT_URL:-unknown}"
    local git_commit="${GIT_COMMIT:-unknown}"
    local jenkins_build="${BUILD_NUMBER:-unknown}"
    local dockerfile_path="${DOCKERFILE_PATH:-Dockerfile}"
    
    cat > "${provenance_file}" << EOF
{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "${PACKAGE_NAME}",
      "digest": {
        "sha256": "pending-build"
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://github.com/docker/build",
      "externalParameters": {
        "source": "${git_url}",
        "commit": "${git_commit}",
        "dockerfile": "${dockerfile_path}"
      }
    },
    "runDetails": {
      "builder": {
        "id": "jenkins-${jenkins_build}"
      },
      "metadata": {
        "invocationId": "jenkins-${jenkins_build}-${PACKAGE_NAME}",
        "startedOn": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
      }
    }
  }
}
EOF
    
    echo "Generated SLSA provenance: ${provenance_file}"
}

# Generate license compliance report
generate_license_report() {
    local license_file="${OUTPUT_DIR}/${PACKAGE_NAME}-licenses.txt"
    
    cat > "${license_file}" << EOF
License Compliance Report for ${PACKAGE_NAME} v${PACKAGE_VERSION}
================================================================

Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")

Package: ${PACKAGE_NAME}
Version: ${PACKAGE_VERSION}
License: See package LICENSE file

Dependencies:
- Ubuntu 26.04 base (various licenses)
- Build tools (GPL, LGPL, MIT)

Compliance Status: REVIEW REQUIRED
- Verify license compatibility with project
- Ensure attribution requirements are met
- Check for copyleft obligations

Notes:
- This is an automated report
- Manual license review is required
- Contact legal team for questions
EOF
    
    echo "Generated license report: ${license_file}"
}

# Main execution
generate_cyclonedx_sbom
generate_slsa_provenance
generate_license_report

echo ""
echo "SBOM generation complete for ${PACKAGE_NAME} v${PACKAGE_VERSION}"
echo "Output directory: ${OUTPUT_DIR}"
ls -la "${OUTPUT_DIR}/"