Feat/support SBOM generation by viveksahu26 · Pull Request #291 · interlynk-io/sbomasm

viveksahu26 · 2026-04-09T15:58:54Z

closes #289
This PR adds the following changes:

added sbom sub-command of generate
- it add new command sbomasm generate sbom
- parse and extract up CLI flags
- implement aritifact/component model
- implement recursive file discovery with Interlynk schema validation
- implement collecting component list, merging it and removing duplicates component
- implement component fieltering using tags
- implement dependency-of resolution and dependency graph construction
- implement CycloneDX SBOM builder
- Implement SPDX SBOM builder
Implemented hash caculation during sbom generation for supported ways
Implemented pedigree support for vendor patches
Replaced dependency-of by depends-on and acoordingly changed it's functionality
Implemented sbomasm generate config command
Updated and added documentation
Added sbomasm generate components command
Added support of strict validatior on strict mode
Added support for version pinning
Performed major features testings
Performed all 24 test suits testing
[Tests]: Added Artifact Parsing Tests
[Tests]: Added Components Parsing Tests

TODO:

write e2e tests

Demo as per current implmentation:

 $ ./sbomasm generate sbom \ 
 -i .components.json \
 -i libs/libmqtt/.components.json \
 -i src/cjson/.components.json \
 -i src/miniz/.components.json \
 -o device-firmware-2.1.0.spdx.json --format spdx

o/p of device-firmware-2.1.0.spdx.json:

{
 "spdxVersion": "SPDX-2.3",
 "dataLicense": "CC0-1.0",
 "SPDXID": "SPDXRef-DOCUMENT",
 "name": "device-firmware",
 "documentNamespace": "https://spdx.org/spdxdocs/device-firmware-b7da2ce2-3af5-4a24-a06c-dd0a6033a129",
 "creationInfo": {
   "creators": [
     "Tool: sbomasm-v2.0.0-20260413160043-47ab5f6b3c99+dirty"
   ],
   "created": "2026-04-13T16:13:23Z"
 },
 "packages": [
   {
     "name": "device-firmware",
     "SPDXID": "SPDXRef-device-firmware-2.1.0",
     "versionInfo": "2.1.0",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "licenseConcluded": "MIT",
     "copyrightText": "Copyright 2026 Acme Corp",
     "description": "Main firmware for Acme IoT gateway",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:generic/acme/device-firmware@2.1.0"
       }
     ]
   },
   {
     "name": "libtls",
     "SPDXID": "SPDXRef-libtls-3.9.0",
     "versionInfo": "3.9.0",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "checksums": [
       {
         "algorithm": "SHA-256",
         "checksumValue": "e3b0c44..."
       }
     ],
     "licenseConcluded": "ISC",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:generic/openbsd/libtls@3.9.0"
       }
     ]
   },
   {
     "name": "libgui",
     "SPDXID": "SPDXRef-libgui-2.0.0",
     "versionInfo": "2.0.0",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "checksums": [
       {
         "algorithm": "SHA-256",
         "checksumValue": "abc123..."
       }
     ],
     "licenseConcluded": "MIT",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:generic/lvgl/libgui@2.0.0"
       }
     ]
   },
   {
     "name": "libmqtt",
     "SPDXID": "SPDXRef-libmqtt-4.3.0",
     "versionInfo": "4.3.0",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "checksums": [
       {
         "algorithm": "SHA-256",
         "checksumValue": "9f86d08..."
       }
     ],
     "licenseConcluded": "EPL-2.0",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:generic/acme/libmqtt@4.3.0"
       }
     ]
   },
   {
     "name": "cjson",
     "SPDXID": "SPDXRef-cjson-1.7.17",
     "versionInfo": "1.7.17",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "checksums": [
       {
         "algorithm": "SHA-256",
         "checksumValue": "d2735c2..."
       }
     ],
     "licenseConcluded": "MIT",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:github/DaveGamble/cJSON@1.7.17"
       }
     ]
   },
   {
     "name": "miniz",
     "SPDXID": "SPDXRef-miniz-3.0.2",
     "versionInfo": "3.0.2",
     "downloadLocation": "NOASSERTION",
     "filesAnalyzed": false,
     "checksums": [
       {
         "algorithm": "SHA-256",
         "checksumValue": "f81bc5a..."
       }
     ],
     "licenseConcluded": "MIT",
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceType": "purl",
         "referenceLocator": "pkg:github/richgel999/miniz@3.0.2"
       }
     ]
   }
 ],
 "relationships": [
   {
     "spdxElementId": "SPDXRef-DOCUMENT",
     "relatedSpdxElement": "SPDXRef-device-firmware-2.1.0",
     "relationshipType": "DESCRIBES"
   },
   {
     "spdxElementId": "SPDXRef-device-firmware-2.1.0",
     "relatedSpdxElement": "SPDXRef-libgui-2.0.0",
     "relationshipType": "DEPENDS_ON"
   },
   {
     "spdxElementId": "SPDXRef-device-firmware-2.1.0",
     "relatedSpdxElement": "SPDXRef-libmqtt-4.3.0",
     "relationshipType": "DEPENDS_ON"
   },
   {
     "spdxElementId": "SPDXRef-device-firmware-2.1.0",
     "relatedSpdxElement": "SPDXRef-cjson-1.7.17",
     "relationshipType": "DEPENDS_ON"
   },
   {
     "spdxElementId": "SPDXRef-device-firmware-2.1.0",
     "relatedSpdxElement": "SPDXRef-miniz-3.0.2",
     "relationshipType": "DEPENDS_ON"
   },
   {
     "spdxElementId": "SPDXRef-libmqtt-4.3.0",
     "relatedSpdxElement": "SPDXRef-libtls-3.9.0",
     "relationshipType": "DEPENDS_ON"
   }
 ]
}

and for cyclonedx:

$ ./sbomasm generate sbom \               
  -i .components.json \
  -i libs/libmqtt/.components.json \
  -i src/cjson/.components.json \
  -i src/miniz/.components.json \
  -o device-firmware-2.1.0.cdx.json

ANd o/p of device-firmware-2.1.0.cdx.json:

{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:17fa1318-7393-4de1-bffc-68daa69f3ea3",
"version": 1,
"metadata": {
  "timestamp": "2026-04-13T16:13:28Z",
  "tools": {
    "components": [
      {
        "type": "application",
        "supplier": {
          "name": "Interlynk",
          "url": [
            "https://interlynk.io"
          ],
          "contact": [
            {
              "email": "support@interlynk.io"
            }
          ]
        },
        "name": "sbomasm",
        "version": "v2.0.0-20260413160043-47ab5f6b3c99+dirty",
        "description": "sbomasm: The Complete SBOM Management Toolkit",
        "licenses": [
          {
            "license": {
              "id": "Apache-2.0"
            }
          }
        ]
      }
    ]
  },
  "component": {
    "bom-ref": "pkg:generic/acme/device-firmware@2.1.0",
    "type": "firmware",
    "supplier": {
      "name": "Acme Corp",
      "contact": [
        {
          "email": "engineering@acme.com"
        }
      ]
    },
    "authors": [
      {
        "name": "Jane Doe",
        "email": "jane@acme.com"
      }
    ],
    "name": "device-firmware",
    "version": "2.1.0",
    "description": "Main firmware for Acme IoT gateway",
    "licenses": [
      {
        "license": {
          "id": "MIT"
        }
      }
    ],
    "copyright": "Copyright 2026 Acme Corp",
    "cpe": "cpe:2.3:a:acme:device-firmware:2.1.0:*:*:*:*:*:*:*",
    "purl": "pkg:generic/acme/device-firmware@2.1.0"
  }
},
"components": [
  {
    "bom-ref": "pkg:generic/openbsd/libtls@3.9.0",
    "type": "library",
    "supplier": {
      "name": "OpenBSD"
    },
    "name": "libtls",
    "version": "3.9.0",
    "hashes": [
      {
        "alg": "SHA-256",
        "content": "e3b0c44..."
      }
    ],
    "licenses": [
      {
        "license": {
          "id": "ISC"
        }
      }
    ],
    "purl": "pkg:generic/openbsd/libtls@3.9.0"
  },
  {
    "bom-ref": "pkg:generic/lvgl/libgui@2.0.0",
    "type": "library",
    "supplier": {
      "name": "LVGL"
    },
    "name": "libgui",
    "version": "2.0.0",
    "hashes": [
      {
        "alg": "SHA-256",
        "content": "abc123..."
      }
    ],
    "licenses": [
      {
        "license": {
          "id": "MIT"
        }
      }
    ],
    "purl": "pkg:generic/lvgl/libgui@2.0.0"
  },
  {
    "bom-ref": "pkg:generic/acme/libmqtt@4.3.0",
    "type": "library",
    "supplier": {
      "name": "Acme Corp"
    },
    "name": "libmqtt",
    "version": "4.3.0",
    "hashes": [
      {
        "alg": "SHA-256",
        "content": "9f86d08..."
      }
    ],
    "licenses": [
      {
        "license": {
          "id": "EPL-2.0"
        }
      }
    ],
    "purl": "pkg:generic/acme/libmqtt@4.3.0"
  },
  {
    "bom-ref": "pkg:github/DaveGamble/cJSON@1.7.17",
    "type": "library",
    "supplier": {
      "name": "Dave Gamble"
    },
    "name": "cjson",
    "version": "1.7.17",
    "hashes": [
      {
        "alg": "SHA-256",
        "content": "d2735c2..."
      }
    ],
    "licenses": [
      {
        "license": {
          "id": "MIT"
        }
      }
    ],
    "purl": "pkg:github/DaveGamble/cJSON@1.7.17"
  },
  {
    "bom-ref": "pkg:github/richgel999/miniz@3.0.2",
    "type": "library",
    "supplier": {
      "name": "Rich Geldreich"
    },
    "name": "miniz",
    "version": "3.0.2",
    "hashes": [
      {
        "alg": "SHA-256",
        "content": "f81bc5a..."
      }
    ],
    "licenses": [
      {
        "license": {
          "id": "MIT"
        }
      }
    ],
    "purl": "pkg:github/richgel999/miniz@3.0.2"
  }
],
"dependencies": [
  {
    "ref": "pkg:generic/acme/libmqtt@4.3.0",
    "dependsOn": [
      "pkg:generic/openbsd/libtls@3.9.0"
    ]
  },
  {
    "ref": "pkg:generic/acme/device-firmware@2.1.0",
    "dependsOn": [
      "pkg:generic/lvgl/libgui@2.0.0",
      "pkg:generic/acme/libmqtt@4.3.0",
      "pkg:github/DaveGamble/cJSON@1.7.17",
      "pkg:github/richgel999/miniz@3.0.2"
    ]
  }
]
}

Copilot

Pull request overview

Adds an SBOM generation workflow to sbomasm via a new generate sbom subcommand, building CycloneDX or SPDX SBOM outputs from distributed component manifest files plus artifact metadata.

Changes:

Introduces pkg/generate/gsbom (artifact config loader, recursive input discovery, JSON/CSV parsing, merge/dedup, tag filtering, dependency graph, serializers).
Adds CLI subcommands under generate: config and sbom, with flags for inputs, recursion, tags, output, and format.
Implements CycloneDX + SPDX JSON serialization for the generated BOM model.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
pkg/generate/gsbom/serializer_spdx.go	SPDX document + package/relationship construction and JSON output
pkg/generate/gsbom/serializer_cdx.go	CycloneDX BOM construction (metadata/components/dependencies) and JSON output
pkg/generate/gsbom/parser.go	Component manifest parsing for JSON + CSV with schema marker validation
pkg/generate/gsbom/merge.go	Merge + dedup helpers; `name@version` keying
pkg/generate/gsbom/input_collector.go	Collects explicit inputs and optionally discovers manifests via recursion
pkg/generate/gsbom/gsbom.go	Orchestrates end-to-end SBOM generation pipeline
pkg/generate/gsbom/filter.go	Tag include/exclude filtering for components
pkg/generate/gsbom/dependency.go	Dependency graph construction from `dependency-of` references
pkg/generate/gsbom/config.go	Loads `.artifact-metadata.yaml` into an internal artifact model
pkg/generate/gsbom/builder.go	Assembles final BOM model (artifact + components + dependency edges)
cmd/generate.go	Converts `generate` into a parent command with subcommands
cmd/generate_sbom.go	Implements `sbomasm generate sbom` command + flags
cmd/generate_config.go	Implements `sbomasm generate config` command

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-09T16:06:56Z

+	for i, col := range columns {
+		colIndex[col] = i
+	}
+


parseCSV builds colIndex from the CSV header but never validates required columns are present. If the CSV is missing/typo’d (e.g., "name"/"version"), lookups like colIndex["name"] will default to 0 and can silently map the wrong column or later cause index-out-of-range panics. Add explicit checks that required headers exist before reading records and return a clear error listing missing columns.

Suggested change

requiredColumns := []string{

"name",

"version",

"type",

"license",

"purl",

"cpe",

"dependency_of",

"tags",

}

var missingColumns []string

for _, col := range requiredColumns {

if _, ok := colIndex[col]; !ok {

missingColumns = append(missingColumns, col)

}

}

if len(missingColumns) > 0 {

return nil, fmt.Errorf("missing required columns: %s", strings.Join(missingColumns, ", "))

}

Copilot · 2026-04-09T16:06:57Z

+		c := Component{
+			Name:    record[colIndex["name"]],
+			Version: record[colIndex["version"]],
+			Type:    record[colIndex["type"]],
+			License: record[colIndex["license"]],
+			PURL:    record[colIndex["purl"]],
+			CPE:     record[colIndex["cpe"]],
+		}


parseCSV indexes into record[...] assuming each row has all expected columns. A short/malformed row will panic with "index out of range". Consider validating len(record) against the max required column index (or using a helper to safely fetch fields) and returning a parsing error with row context instead of panicking.

Copilot · 2026-04-09T16:06:57Z

+		// dependency_of
+		if v := record[colIndex["dependency_of"]]; v != "" {
+			c.DependencyOf = strings.Split(v, ",")
+		}
+
+		// tags
+		if v := record[colIndex["tags"]]; v != "" {
+			c.Tags = strings.Split(v, ",")
+		}


When splitting CSV fields like dependency_of and tags on commas, values aren’t TrimSpace’d. This makes common inputs like "libtls@3.9.0, libfoo@1.2.3" fail dependency resolution / tag matching due to leading spaces. Trim whitespace for each entry and drop empty strings after splitting.

Copilot · 2026-04-09T16:06:57Z

+	if doc.Schema != "interlynk/component-manifest/v1" {
+		return nil, fmt.Errorf("invalid schema")
+	}


The schema validation error "invalid schema" doesn’t include the schema value that was found or the expected value, which makes debugging harder. Include both (and ideally the file path) in the returned error message.

Copilot · 2026-04-09T16:06:57Z

+	for _, c := range components {
+		childKey := componentKey(c)
+
+		// Case 1: has dependency-of
+		if len(c.DependencyOf) > 0 {
+			for _, parentRef := range c.DependencyOf {
+
+				// Check if parent exists
+				if _, ok := compMap[parentRef]; !ok {
+					warnings = append(warnings,
+						fmt.Errorf("missing dependency reference: %s → %s", childKey, parentRef))
+					continue
+				}
+
+				// parent -> child
+				graph.Edges[parentRef] = append(graph.Edges[parentRef], childKey)
+			}
+		} else {
+			// Case 2: top-level (handled later in SBOM builder)
+			continue
+		}


If a component has DependencyOf entries but all of them are missing from compMap, this function only emits warnings and the component becomes disconnected: it won’t be treated as top-level (len(DependencyOf)!=0) and no edge is added. Consider either (a) treating components with no valid parents as top-level, or (b) returning an error so the generated SBOM doesn’t silently omit dependency relationships for that component.

Copilot · 2026-04-09T16:06:58Z

+	// 1. Add explicit inputs FIRST
+	files = append(files, params.InputFiles...)
+
+	// 2. Handle recurse
+	if params.RecursePath != "" {
+		err := filepath.Walk(params.RecursePath, func(path string, info os.FileInfo, err error) error {
+			if err != nil {
+				warnings = append(warnings, fmt.Errorf("error accessing path %s: %v", path, err))
+				return nil
+			}
+
+			if info.IsDir() {
+				return nil
+			}
+
+			// Match filename
+			if info.Name() == params.Filename {
+				files = append(files, path)
+			}


CollectInputFiles can return duplicate paths when the same file is provided via --input and also discovered via --recurse (or if inputs repeat). That leads to redundant parsing and can inflate duplicate-component warnings. Consider de-duplicating file paths (e.g., by absolute/cleaned path) before returning.

Copilot · 2026-04-09T16:06:58Z

+	"fmt"
+	"os"
+
+	"go.yaml.in/yaml/v2"


This file imports go.yaml.in/yaml/v2 while the rest of the repo uses gopkg.in/yaml.v2 (e.g., pkg/assemble/config.go:33). Using a different YAML module increases dependency surface and can cause subtle behavior differences. Prefer the same YAML package already used elsewhere unless there’s a specific need.

Suggested change

"go.yaml.in/yaml/v2"

"gopkg.in/yaml.v2"

Copilot · 2026-04-09T16:06:58Z

+	generateSbomCmd.Flags().StringP("config", "c", ".artifact-metadata.yaml", "artifact metadata config file")
+	generateSbomCmd.Flags().StringSliceP("input", "i", []string{}, "component input files")
+	generateSbomCmd.Flags().StringP("output", "o", "", "output SBOM file (default stdout)")
+	generateSbomCmd.Flags().StringSliceP("tags", "t", []string{}, "include components with these tags")
+	generateSbomCmd.Flags().StringSlice("exclude-tags", []string{}, "exclude components with these tags")
+	generateSbomCmd.Flags().String("format", "cyclonedx(default)", "output format (cyclonedx|spdx)")
+	generateSbomCmd.Flags().StringP("recurse", "r", "", "recursively discover component files")
+	generateSbomCmd.Flags().String("filename", ".components.json", "filename for recursive discovery")


The --format flag default is "cyclonedx(default)", but the help text advertises accepted values "cyclonedx|spdx". This makes the default not match the documented set and can confuse users/scripts. Prefer defaulting to "cyclonedx" and (optionally) validate the flag value to error on unknown formats instead of silently falling back.

Copilot · 2026-04-09T16:06:59Z

 var generateCmd = &cobra.Command{
 	Use:   "generate",
 	Short: "Generate a sample config file for assembling sboms",
 	Long: `The generate command will generate a sample config file for assembling sboms.
 Example:
-	$ sbomasm generate > config.yaml
-
-Please fill in all the fields that are known. Unknown fields can be left blank.`,
-	Args:         cobra.NoArgs,
-	SilenceUsage: true,
-	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Printf("%s", assemble.DefaultConfigYaml())
-	},
+	$ sbomasm generate config
+	$ sbomasm generate sbom -r . -o device-firmware-2.1.0.cdx.json
+	$ sbomasm generate sbom \
+	  -i .components.json \
+	  -i libs/libmqtt/.components.json \
+	  -i src/cjson/.components.json \
+	  -i src/miniz/.components.json \
+	  -o device-firmware-2.1.0.cdx.json
+`,


generateCmd’s Short/Long text still describes only generating a sample assemble config, but the command now has subcommands (config, sbom). Update the help text to reflect the new structure and avoid misleading CLI users.

Copilot · 2026-04-09T16:06:59Z

+var generateConfigCmd = &cobra.Command{
+	Use:   "config",
+	Short: "Generate artifact metadata config",
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Printf("%s", assemble.DefaultConfigYaml())
+	},


generate config is described as generating artifact metadata, but it prints assemble.DefaultConfigYaml(), which includes unrelated sections (output/assemble) not used by gsbom’s .artifact-metadata.yaml parser. Consider generating a minimal artifact-metadata template (app section only) to match the command’s intent and the PR description.

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 added 3 commits April 9, 2026 13:54

add sbom generation sub-command

01db9d3

fix deps issue

f9da463

fix some more issues

2f0d8fc

Copilot AI review requested due to automatic review settings April 9, 2026 15:58

Copilot started reviewing on behalf of viveksahu26 April 9, 2026 15:59 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

viveksahu26 added 24 commits April 10, 2026 12:01

add comments and update func

1aeb922

make function usable

2a2dc41

fix cdx serializer

34b24f4

fix spdx serializer

bc2dbff

add some basic test

5340034

add config sub-command

cc3c7dd

fix spdxid, and other bugs

4cac633

enrich more values to components

47ab5f6

comment out author, supplier in spdx

e260b9c

fix self-ref looping issue

e7d7aea

fix cycle detection

9458675

fix deps duplicacy

0073e4f

fix duplicates components with deps

2f668d5

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

sone minor fixes

2441a2d

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix o/p and warnings

0b843f0

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix tag whitespace

d9f71fd

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix missing schema warnings

6e2dbc7

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix path extension

ba4703f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fixes recursive discovery

c1b8d60

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix csv missing column, handle panic

6dcc47e

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix spdx deps duplicacy

ceffc9b

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add spdx mising supplier and author in o/p

e4b966b

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

replace hardcore type value to provided component type value

8050856

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

detect license expression

f42fa9f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

load lifecycle in artifact model

abfcad0

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

This was referenced Apr 20, 2026

test(generate): integration tests + gap report for generate sbom (depends on #291) #293

Closed

test(generate): e2e integration tests + gap report for generate sbom (depends on #291) #294

Closed

viveksahu26 added 26 commits April 21, 2026 10:43

map output section in artifact

665b17f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

validate schema for explicit and recurssive

7b7630f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

throw hard for hashes and pedigree on invalid file

5f10618

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

bom-ref fallback to generic purl

f8ef2ee

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

read var SOURCE_DATE_EPOCH, use in cdx/spdx

650d06c

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix serial id for valid schema

264a3a2

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

sort by bom-ref

de94f22

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

drop component with excluded scope

be20a80

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add 4 more component types

7bb3230

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

support all four forms of license

68d80f6

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

some more fixes

48d163d

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

hard error on malformed/invalid schema

b047331

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix supplier

483fc22

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

update component schema

e93ab18

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

validate components

4497666

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add validate flag to validate against official schema

6cae1f6

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

validate spdx hash algo during serialization, otherwise warn, skip it

4aa0e29

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

validate ext ref type during serialization, otherwise warn

34ad8d7

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add artifact possible test-cases

0905b6a

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add components parsing into component model tests

02975fc

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

remove irrelevant tests

66148c4

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

small update

1e8798f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

write app config to artifact-metadata.yaml file by default

5539732

update commands options description

2caf453

populate license text when license file is provided

8d0f0e1

update output

e9564ab

viveksahu26 requested a review from riteshnoronha April 24, 2026 15:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/support SBOM generation#291

Feat/support SBOM generation#291
viveksahu26 wants to merge 71 commits intointerlynk-io:mainfrom
viveksahu26:feat/support_sbom_generation

viveksahu26 commented Apr 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

+	requiredColumns := []string{
+		"name",
+		"version",
+		"type",
+		"license",
+		"purl",
+		"cpe",
+		"dependency_of",
+		"tags",
+	}
+	var missingColumns []string
+	for _, col := range requiredColumns {
+		if _, ok := colIndex[col]; !ok {
+			missingColumns = append(missingColumns, col)
+		}
+	}
+	if len(missingColumns) > 0 {
+		return nil, fmt.Errorf("missing required columns: %s", strings.Join(missingColumns, ", "))
+	}

Conversation

viveksahu26 commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

viveksahu26 commented Apr 9, 2026 •

edited

Loading