| """ |
| Dynamic SBOM (Software Bill of Materials) Generator for CFI Platform. |
| Generates a genuine CycloneDX 1.5 compliant SBOM from the active Python distribution |
| metadata and the frontend npm manifest. |
| |
| Outputs: |
| storage/sbom_cyclonedx.json |
| """ |
|
|
| import datetime |
| import importlib.metadata |
| import json |
| import sys |
| import uuid |
| from pathlib import Path |
|
|
|
|
| def generate_sbom(output_path: Path = Path("storage/sbom_cyclonedx.json")) -> dict: |
| output_path.parent.mkdir(parents=True, exist_ok=True) |
|
|
| components = [] |
|
|
| |
| dists = list(importlib.metadata.distributions()) |
| for dist in dists: |
| name = dist.metadata.get("Name") |
| version = dist.metadata.get("Version") |
| if not name or not version: |
| continue |
|
|
| license_name = dist.metadata.get("License") or "Unknown" |
| summary = dist.metadata.get("Summary") or "" |
|
|
| component = { |
| "type": "library", |
| "bom-ref": f"pkg:pypi/{name.lower()}@{version}", |
| "name": name, |
| "version": version, |
| "description": summary[:200] if summary else "", |
| "licenses": [{"license": {"id": license_name}} if license_name in ["MIT", "Apache-2.0", "BSD-3-Clause", "MPL-2.0"] else {"license": {"name": license_name[:50]}}], |
| "purl": f"pkg:pypi/{name.lower()}@{version}", |
| "properties": [ |
| {"name": "ecosystem", "value": "pypi"} |
| ] |
| } |
| components.append(component) |
|
|
| |
| frontend_pkg_path = Path("frontend/package.json") |
| if frontend_pkg_path.exists(): |
| try: |
| with open(frontend_pkg_path, encoding="utf-8") as f: |
| pkg_data = json.load(f) |
| deps = pkg_data.get("dependencies", {}) |
| dev_deps = pkg_data.get("devDependencies", {}) |
| for dep_name, dep_ver in {**deps, **dev_deps}.items(): |
| clean_ver = dep_ver.lstrip("^~") |
| components.append({ |
| "type": "library", |
| "bom-ref": f"pkg:npm/{dep_name}@{clean_ver}", |
| "name": dep_name, |
| "version": clean_ver, |
| "purl": f"pkg:npm/{dep_name}@{clean_ver}", |
| "properties": [ |
| {"name": "ecosystem", "value": "npm"} |
| ] |
| }) |
| except Exception as exc: |
| print(f"Warning reading frontend package.json: {exc}", file=sys.stderr) |
|
|
| |
| components.sort(key=lambda c: c["name"].lower()) |
|
|
| sbom = { |
| "bomFormat": "CycloneDX", |
| "specVersion": "1.5", |
| "serialNumber": f"urn:uuid:{uuid.uuid4()}", |
| "version": 1, |
| "metadata": { |
| "timestamp": datetime.datetime.now(datetime.UTC).isoformat(), |
| "tools": [ |
| { |
| "vendor": "CF-Intelligence", |
| "name": "cfi-sbom-generator", |
| "version": "1.0.0" |
| } |
| ], |
| "component": { |
| "type": "application", |
| "name": "privacy-preserving-cross-bank-fraud-detection", |
| "version": "1.0.0", |
| "licenses": [{"license": {"id": "MIT"}}] |
| } |
| }, |
| "components": components |
| } |
|
|
| with open(output_path, "w", encoding="utf-8") as f: |
| json.dump(sbom, f, indent=2) |
|
|
| print(f"Generated CycloneDX 1.5 SBOM with {len(components)} components -> {output_path}") |
| return sbom |
|
|
|
|
| if __name__ == "__main__": |
| generate_sbom() |
|
|
