enricobuehlerandClaude Fable 5
5d018eea7c
CRA Annex I Part II groundwork (see punktfunk-planning design/cra-readiness.md, Phase 1): * sbom.yml + scripts/ci/gen-sbom.sh: every vX.Y.Z release gets a CycloneDX SBOM attached — syft over both Cargo.locks, all Bun/pnpm trees and the Swift Package.resolved (2,667 components), merged with compliance/sbom/manual-components.cdx.json for what no lockfile records (pyrowave/Granite/volk/Vulkan-Headers pins, libvpl, FFmpeg, SDL3, VB-CABLE, punktfunk-gamescope). * audit.yml: bun audit now covers sdk + plugin-kit (not just web), decky's pnpm tree is scanned, and docs-site runs non-blocking until its known CMS-chain advisories are cleared. All shipping trees verified green today. * license-gate: about.toml's allowlist claim is finally enforced — cargo-about 0.9.1 with --fail over BOTH workspaces. The old [crate.clarify] license-only syntax fails to deserialize under 0.9; migrated ring to a per-crate accepted extension and dropped the stale aws-lc-sys entry (workspace is ring-only). Both gates validated green locally. * drivers/Cargo.lock: sync the pf-dualsense→pf-gamepad rename — the crate rename updated the manifest but the Windows-only lockfile was never regenerated; cargo-about's metadata pass caught it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
32 lines
1.5 KiB
Bash
Executable File
32 lines
1.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# Generate the per-release CycloneDX SBOM (CRA Annex I Part II §1 — machine-readable component
|
|
# inventory, attached to every stable release by .gitea/workflows/sbom.yml).
|
|
#
|
|
# syft walks the checkout and catalogs every lockfile-pinned dependency (both Rust workspaces via
|
|
# their Cargo.locks, the Bun/pnpm/npm trees, the Swift Package.resolved);
|
|
# compliance/sbom/manual-components.cdx.json contributes the components no lockfile records —
|
|
# vendored C/C++ trees (pyrowave/Granite/volk/Vulkan-Headers, libvpl), dynamically-linked/bundled
|
|
# libraries (FFmpeg, SDL3), the redistributed VB-CABLE driver, and the patched gamescope. Keep
|
|
# that file current when vendoring changes (scripts/vendor-pyrowave.sh etc.).
|
|
#
|
|
# Usage: scripts/ci/gen-sbom.sh VERSION [OUTPUT]
|
|
# Requires: syft (pinned install in the workflow), python3 (a proven runner dependency).
|
|
set -eu
|
|
VERSION="${1:?usage: gen-sbom.sh VERSION [OUTPUT]}"
|
|
OUT="${2:-punktfunk-${VERSION}.cdx.json}"
|
|
TMP="${OUT}.syft.tmp"
|
|
|
|
syft scan "dir:." --source-name punktfunk --source-version "$VERSION" \
|
|
-o "cyclonedx-json=$TMP" -q
|
|
|
|
OUT="$OUT" TMP="$TMP" python3 - <<'PY'
|
|
import json, os
|
|
gen = json.load(open(os.environ["TMP"]))
|
|
manual = json.load(open("compliance/sbom/manual-components.cdx.json"))
|
|
gen.setdefault("components", []).extend(manual["components"])
|
|
with open(os.environ["OUT"], "w") as f:
|
|
json.dump(gen, f, indent=2)
|
|
print("SBOM: %d components -> %s" % (len(gen["components"]), os.environ["OUT"]))
|
|
PY
|
|
rm -f "$TMP"
|