Feature/multi ecosystem SBOM - #720
Merged
Merged
Conversation
added 2 commits
July 29, 2026 10:36
…r replay Feature A - DWARF version detection in sourcemap resolver - Add internal/sourcemap/dwarf_capabilities.go: CapabilityReport type, DetectCapabilitiesFromBytes/File, severity mapping, DWARFCapabilityReport accessor - Update Resolver.AutoDiscoverLocalSymbols: capability detection before DWARF parsing, structured per-issue log entries, early return on unsupported binary - Add dwarf_capabilities_test.go: 10 fixture-based tests (stripped, partial, modern, unsupported v1, future v6, missing-abbrev, nil safety, severity mapping) Feature B - Versioned SPDX 2.3 SBOM for release packaging - Add internal/sbom/: Component, BuildPURL/BuildSPDXID, ParseGoModules, ParseCargoLock (no TOML dep), ParsePackageLock (npm v1/v2/v3), GenerateDocument (sorted+deduped, DocumentHash), Marshal, Validate, GenerateFromFiles (3-ecosystem merge, non-fatal missing-file warnings); 18 tests - Add cmd/generate-sbom/: CLI --version/--commit/--go-modules/--cargo-lock/ --package-lock/--output/--verify, prints output path to stdout; 8 tests - Update cmd/generate-release-manifest: isSBOMFile, detectSBOMRef auto-detection, auto-populate SBOMRef from dist dir; 4 new tests Feature C - Canonical network snapshot for replay validation - Add internal/replay/network_snapshot.go: NetworkSnapshot (Name/Passphrase/ ProtocolVersion/RPCURL), Hash (RPCURL excluded), Compatible (3-field check, protocol zero-skip), NetworkSnapshotMismatchError with remediation hint, ValidateNetworkSnapshot with OverrideCrossNetwork that sets NetworkOverrideActive - Update internal/replay/registry.go: NetworkSnapshot field (omitempty), NewWithNetworkSnapshot constructor, LoadFromFile back-fills from legacy Network - Add network_snapshot_test.go: 30 tests (custom networks, passphrase mismatches, override visibility, legacy back-fill, deterministic hash, round-trip)
- Add license-policy.json: canonical allowed/disallowed SPDX identifiers
and vulnerability severity thresholds (fail on HIGH+) for all three
ecosystems. Single source of truth for Go, Rust, and npm policy.
- Update .cargo/deny.toml: add macOS targets, [output] feature-depth,
BlueOak-1.0.0 and Apache-2.0 WITH LLVM-exception to allow list,
syn/proc-macro2/quote to bans.skip, and SYNC NOTE cross-references
to license-policy.json.
- Add scripts/generate-sbom.sh: orchestrates go list -m -json all,
Cargo.lock, and package-lock.json collection then delegates to the
generate-sbom binary. Prints the SBOM output path to stdout for
capture in CI pipelines.
- Add scripts/verify-sbom.sh: validates SPDX 2.3 structure, ecosystem
PURL coverage, version cross-checks against all three lockfiles, and
manifest coverage (SHA-256 + sbom_ref field). Supports --strict mode.
- Add scripts/sbom-vuln-scan.sh: runs osv-scanner against go.sum,
Cargo.lock, and package-lock.json plus the SBOM itself. Parses JSON
report and applies the HIGH+ fail threshold from license-policy.json.
Writes table, JSON, and SARIF reports to vuln-reports/.
- Update .github/workflows/release.yml:
- Add generate-sbom job (after package, needs build-go/build-ts/test-go)
that collects all lockfiles, calls generate-sbom, verifies the SBOM
against lockfiles, and uploads the SBOM as a release artifact.
- Add sbom-vuln-scan job (after generate-sbom) that installs
osv-scanner and fails the pipeline on CRITICAL/HIGH CVEs; uploads
table, JSON, and SARIF scan reports; forwards SARIF to the GitHub
Security tab via codeql-action/upload-sarif.
- Update sign-manifest to depend on generate-sbom and sbom-vuln-scan,
download the SBOM-bundled release artifact, and auto-detect the SBOM
via --sbom-ref.
- Add *.spdx.json to the publish job file list and document SBOM
verification in the GitHub Release body.
- Update .gitignore: whitelist license-policy.json alongside other
tracked JSON config files (*.json rule was blocking it).
Acceptance criteria met:
- SBOM includes Go modules, Cargo crates, and npm packages
- Component versions match lockfiles (cross-checked by verify-sbom.sh)
- Generation is reproducible (DocumentHash over sorted packages slice)
- Release manifest covers the SBOM (SHA-256 verified by verify-sbom.sh)
|
@UG001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(sbom): multi-ecosystem SPDX 2.3 SBOM generation and verification
Produce a versioned SPDX 2.3 SBOM as part of release packaging, covering
Go modules, Cargo crates, and npm packages, with license policy enforcement,
vulnerability scanning, and signed manifest coverage verification.
Add license-policy.json: canonical allowed/disallowed SPDX identifiers
and vulnerability thresholds (fail on HIGH+) for all three ecosystems
Update .cargo/deny.toml: macOS targets, BlueOak-1.0.0 and
Apache-2.0 WITH LLVM-exception in allow list, [output] feature-depth,
syn/proc-macro2/quote to bans.skip, SYNC NOTE refs to license-policy.json
Add scripts/generate-sbom.sh: collects go list output, Cargo.lock, and
package-lock.json then calls generate-sbom; prints path to stdout
Add scripts/verify-sbom.sh: validates SPDX 2.3 structure, ecosystem
PURL coverage, version cross-checks against all three lockfiles, and
SHA-256 coverage by the signed release manifest
Add scripts/sbom-vuln-scan.sh: runs osv-scanner against go.sum,
Cargo.lock, package-lock.json, and the SBOM; writes table/JSON/SARIF
reports; fails on CRITICAL/HIGH CVEs per policy
Update release.yml: add generate-sbom job (after package) and
sbom-vuln-scan job (after generate-sbom); sign-manifest now depends on
both; SARIF forwarded to GitHub Security tab; *.spdx.json added to
publish artifacts
Acceptance criteria met:
closes Issue 41: Add DWARF version compatibility reporting #548 closes Issue 113: Generate an SBOM for Go, Rust, and Node dependencies #620 closes Issue 16: Add deterministic network configuration snapshots #523