Generate SBOM

.github/workflows/build.yml

@@ -6,11 +6,16 @@ jobs:
     runs-on: macos-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Build
-      run: xcodebuild -project EstEIDTokenApp.xcodeproj -target package CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO DSTROOT=$PWD/tmp CURRENT_PROJECT_VERSION=${{ github.run_number }} install
-    - name: Archive artifacts
-      uses: actions/upload-artifact@v4
+      run: xcodebuild -project EstEIDTokenApp.xcodeproj -target package CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CURRENT_PROJECT_VERSION=${{ github.run_number }} install
+    - name: Archive pkg artifact
+      uses: actions/upload-artifact@v7
       with:
         name: pkg
         path: ./*.pkg
+    - name: Archive SBOM artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: sbom
+        path: ./*.spdx.json

EstEIDToken/Token.swift

@@ -1,21 +1,5 @@
-/*
- * EstEIDToken
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import CryptoTokenKit
 import UserNotifications

EstEIDToken/TokenSession.swift

@@ -1,21 +1,5 @@
-/*
- * EstEIDToken
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import CryptoTokenKit
 

EstEIDTokenApp.xcodeproj/project.pbxproj

@@ -229,13 +229,16 @@
 			files = (
 			);
 			inputPaths = (
+				"$(DSTROOT)",
 			);
 			name = "Build package";
 			outputPaths = (
+				"$(SRCROOT)/esteid-ctk-tokend_$(MARKETING_VERSION).$(CURRENT_PROJECT_VERSION).pkg",
+				"$(SRCROOT)/esteid-ctk-tokend_$(MARKETING_VERSION).$(CURRENT_PROJECT_VERSION).spdx.json",
 			);
 			runOnlyForDeploymentPostprocessing = 1;
 			shellPath = /bin/sh;
-			shellScript = "if [ \"${CODE_SIGNING_REQUIRED}\" != \"NO\" ]; then\n  SIGN=(--sign \"${DEVELOPMENT_TEAM}\")\nfi\npkgbuild --root ${DSTROOT} --install-location / --identifier ee.ria.esteid-ctk-tokend --version ${MARKETING_VERSION}.${CURRENT_PROJECT_VERSION} \"${SIGN[@]}\" esteid-ctk-tokend_${MARKETING_VERSION}.${CURRENT_PROJECT_VERSION}.pkg\n";
+			shellScript = "if [ \"${CODE_SIGNING_REQUIRED}\" != \"NO\" ]; then\n  SIGN=(--sign \"${DEVELOPMENT_TEAM}\")\nfi\npkgbuild --root ${DSTROOT} --install-location / --identifier ee.ria.esteid-ctk-tokend --version ${MARKETING_VERSION}.${CURRENT_PROJECT_VERSION} \"${SIGN[@]}\" \"${SRCROOT}/esteid-ctk-tokend_${MARKETING_VERSION}.${CURRENT_PROJECT_VERSION}.pkg\"\npython3 << 'PYEOF'\nimport json, uuid, datetime, os\nv = os.environ['MARKETING_VERSION']\nb = os.environ['CURRENT_PROJECT_VERSION']\nt = datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')\nu = str(uuid.uuid4())\nmeta = {'versionInfo': v, 'supplier': 'Organization: ria.ee', 'downloadLocation': 'https://github.com/open-eid/esteid-ctk-tokend/releases', 'filesAnalyzed': False, 'licenseConcluded': 'LGPL-2.1-or-later', 'licenseDeclared': 'LGPL-2.1-or-later', 'copyrightText': os.environ['INFOPLIST_KEY_NSHumanReadableCopyright']}\npkgs = [\n  dict(name='esteid-ctk-tokend', SPDXID='SPDXRef-Package-esteid-ctk-tokend', primaryPackagePurpose='INSTALL',      **meta),\n  dict(name='EstEIDTokenApp',    SPDXID='SPDXRef-Package-EstEIDTokenApp',    primaryPackagePurpose='APPLICATION',   **meta),\n  dict(name='EstEIDToken',       SPDXID='SPDXRef-Package-EstEIDToken',       primaryPackagePurpose='LIBRARY',       **meta),\n]\nrels = [\n  {'spdxElementId': 'SPDXRef-DOCUMENT',                 'relatedSpdxElement': 'SPDXRef-Package-esteid-ctk-tokend', 'relationshipType': 'DESCRIBES'},\n  {'spdxElementId': 'SPDXRef-Package-esteid-ctk-tokend','relatedSpdxElement': 'SPDXRef-Package-EstEIDTokenApp',    'relationshipType': 'CONTAINS'},\n  {'spdxElementId': 'SPDXRef-Package-EstEIDTokenApp',   'relatedSpdxElement': 'SPDXRef-Package-EstEIDToken',       'relationshipType': 'CONTAINS'},\n]\nd = {'spdxVersion': 'SPDX-2.3', 'dataLicense': 'CC0-1.0', 'SPDXID': 'SPDXRef-DOCUMENT', 'name': 'esteid-ctk-tokend', 'documentNamespace': 'https://github.com/open-eid/esteid-ctk-tokend/sbom-' + u, 'creationInfo': {'licenseListVersion': '3.28', 'creators': ['Organization: ria.ee', 'Tool: pkgbuild'], 'created': t}, 'packages': pkgs, 'relationships': rels}\nopen(os.path.join(os.environ['SRCROOT'], f'esteid-ctk-tokend_{v}.{b}.spdx.json'), 'w').write(json.dumps(d, indent=4))\nPYEOF\n";
 			showEnvVarsInLog = 0;
 		};
 /* End PBXShellScriptBuildPhase section */
@@ -282,7 +285,6 @@
 				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++17";
 				CLANG_ENABLE_MODULES = YES;
 				CLANG_ENABLE_OBJC_ARC = YES;
 				CLANG_ENABLE_OBJC_WEAK = YES;
@@ -318,7 +320,6 @@
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
 				GCC_NO_COMMON_BLOCKS = YES;
 				GCC_OPTIMIZATION_LEVEL = 0;
 				GCC_PREPROCESSOR_DEFINITIONS = (
@@ -331,8 +332,9 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright (C) 2017 - 2026 Estonian Information System Authority";
 				LOCALIZATION_PREFERS_STRING_CATALOGS = NO;
-				MACOSX_DEPLOYMENT_TARGET = 13.0;
+				MACOSX_DEPLOYMENT_TARGET = 14.0;
 				MARKETING_VERSION = 1.7.0;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = macosx;
@@ -352,7 +354,6 @@
 				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++17";
 				CLANG_ENABLE_MODULES = YES;
 				CLANG_ENABLE_OBJC_ARC = YES;
 				CLANG_ENABLE_OBJC_WEAK = YES;
@@ -390,16 +391,16 @@
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
 				GCC_NO_COMMON_BLOCKS = YES;
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
 				GCC_WARN_UNDECLARED_SELECTOR = YES;
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "Copyright (C) 2017 - 2026 Estonian Information System Authority";
 				LOCALIZATION_PREFERS_STRING_CATALOGS = NO;
-				MACOSX_DEPLOYMENT_TARGET = 13.0;
+				MACOSX_DEPLOYMENT_TARGET = 14.0;
 				MARKETING_VERSION = 1.7.0;
 				SDKROOT = macosx;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;

EstEIDTokenApp/EstEidTokenApp.swift

@@ -1,21 +1,5 @@
-/*
- * EstEIDTokenApp
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import SwiftUI
 import UserNotifications

README.md

@@ -1,6 +1,6 @@
 # esteid-ctk-tokend
 
- * License: LGPL 2.1
+ * License: LGPL-2.1-or-later
  * © Estonian Information System Authority
  * [Architecture of ID-software](http://open-eid.github.io)
 
@@ -24,12 +24,16 @@
 
         xcodebuild -project EstEIDTokenApp.xcodeproj build
 
- 4. Usage
+ 4. Build installer package
+
+        xcodebuild -project EstEIDTokenApp.xcodeproj -target package CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO install
+
+ 5. Usage
 
         Execute blank "EstEIDTokenApp.app" application and it registers the extension.
         Open Safari and use site with client certificate requirement.
 
- 5. Debug
+ 6. Debug
 
         Open Console.app and filter EstEID logs
         Load extension