Add SBOM artifact using cyclonedx-gomod

[afbjorklund]

One for lima as a library, one for each cmd.

https://github.com/CycloneDX/cyclonedx-gomod

  app      Generate SBOMs for applications
  bin      Generate SBOMs for binaries
  mod      Generate SBOMs for modules

Closes #5219

Minor license problem with one dependency:

WRN no licenses detected module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e

DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e

i.e. they forgot to say "MIT License" :-)

https://github.com/balajiv113/fd/blob/master/LICENSE.MIT

https://spdx.org/licenses/MIT.html

TODO:

• Use GitHub Actions for installing cyclonedx-gomod, instead of go install? cyclonedx-gomod-generate-sbom
  Using go hack/tools instead.
• The repository’s README file contains a SBOM section that explains where they are published to, format used, etc.
  Published to GitHub Releases.

The scope of this PR is to declare what software source code that went into the compiled binaries:

bom.json (mod)
lima-guestagent.Linux-x86_64.bom.json (app)
limactl-mcp.Linux-x86_64.bom.json (app)
limactl.Linux-x86_64.bom.json (app)

It does not do any files (e.g. checksums) or architectures, and does not cover any external drivers.

---

EDIT: The "app" SBOM actually was per-arch, while the "mod" SBOM is the same for all architectures.

The tool doesn't support cross-compiling, since it needs to be able to run a binary for the OS/ARCH.

[afbjorklund]

Converted to draft, while the scope of sbom is being discussed, and to exclude it from release concerns.

The main shortcomings of the current report is that it doesn't include the "supplier" or the "copyright".

---

NTIA (2021)

SBOM Quality Score: 8.6/10.0 Grade: B Components: 107 EngineVersion: 8 File: bom.json

+------------------------------+--------------------+-----------+--------------------------------+
|           PROFILE            |      FEATURE       |  STATUS   |              DESC              |
+------------------------------+--------------------+-----------+--------------------------------+
| NTIA Minimum Elements (2021) | comp_supplier      | 0.0/10.0  | supplier or manufacturer       |
|                              |                    |           | information missing for all    |
|                              |                    |           | 107 components                 |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_name          | 10.0/10.0 | name declared for all          |
|                              |                    |           | components                     |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_version       | 10.0/10.0 | version declared for all       |
|                              |                    |           | components                     |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_uniq_id       | 10.0/10.0 | unique identifier declared for |
|                              |                    |           | all components (PURL)          |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_relationships | 10.0/10.0 | primary component declares     |
|                              |                    |           | 48 direct (top-level)          |
|                              |                    |           | dependencies                   |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_authors       | 10.0/10.0 | SBOM author inferred from SBOM |
|                              |                    |           | generation tool                |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_timestamp     | 10.0/10.0 | SBOM creation timestamp        |
|                              |                    |           | declared                       |
+------------------------------+--------------------+-----------+--------------------------------+

Summary:
Required Fields : 6/7 compliant

NTIA (2025)

SBOM Quality Score: 6.9/10.0 Grade: D Components: 107 EngineVersion: 8 File: bom.json

+--------------------------------+----------------------+-----------+-----------------------+
|            PROFILE             |       FEATURE        |  STATUS   |         DESC          |
+--------------------------------+----------------------+-----------+-----------------------+
| NTIA Minimum Elements (2025) - | sbom_machine_format  | 10.0/10.0 | complete              |
| RFC                            |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_author          | 0.0/10.0  | add authors           |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | software_producer    | 0.0/10.0  | add software producer |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_name            | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_version         | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | software_identifiers | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_hash            | 9.9/10.0  | add to 1 component    |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | license              | 0.0/10.0  | add to 107 components |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_dependencies    | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_supplier        | 0.0/10.0  | add to 107 components |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | tool_name            | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_timestamp       | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | generation_context   | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+--------------------------------+----------------------+-----------+-----------------------+

Summary:
Required Fields : 8/13 compliant

---

Any value for the supplier is accepted, so it could be "name: Unknown" etc.

The licenses needs to be asserted (from "evidence"), and 3 licenses added.

WRN no licenses detected module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e
WRN no licenses detected module=github.com/fatih/color@v1.19.0
WRN no licenses detected module=github.com/jinzhu/copier@v0.4.0

The threshold for go-license-detector SPDX is currently hardcoded to 85%.

DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e
DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/fatih/color@v1.19.0
DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/jinzhu/copier@v0.4.0

Upgrading to github.com/go-enry/go-license-detector/v4 v4.3.1 will fix:

|                                | license              | 9.7/10.0  | add to 3 components   |

[
	{
		"project": "vendor/github.com/balajiv113/fd",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.90066224,
				"file": "LICENSE.MIT"
			}
		]
	},
	{
		"project": "vendor/github.com/fatih/color",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.9096774,
				"file": "LICENSE.md"
			}
		]
	},
	{
		"project": "vendor/github.com/jinzhu/copier",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.9096774,
				"file": "License"
			}
		]
	}
]

The missing hash on the top component (lima), is another such issue:

|                                | comp_hash            | 9.9/10.0  | add to 1 component    |

                if module.Main {
                        // We currently don't have an accurate way of hashing the main module, as it may contain
                        // files that are .gitignore'd and thus not part of the hashes in Go's sumdb.
                        logger.Debug().Str("module", module.Coordinates()).Msg("not calculating hash for main module")
                        return nil
                }

The new fields sbom_author and software_producer should be simple:

metadata.(authors/author) "The person(s) who created the BOM."

Authors are common in BOMs created through manual processes.
BOMs created through automated means may have @.manufacturer instead.

metadata.(supplier/manufacturer) "The organization that created the BOM."

The organization that supplied the component that the BOM describes.
The supplier may often be the manufacturer, but may also be a distributor or repackager.

https://cyclonedx.org/docs/1.6/json/

[afbjorklund]

Here's the hack to get a perfect score with sbomqs, adding the missing fields:

#!/usr/bin/env python3

import sys
import json

# organizationalContact
AUTHOR = {"name": "Unknown", "email": "unknown@example.com"}

# organizationalEntity
MANUFACTURER = {"name": "Unknown", "url": ["https://example.com"]}

# organizationalEntity
SUPPLIER = {"name": "Unknown"}

# organizationalEntity
NOASSERTION = {"name": "Unknown"}


def fix(sbom):
    metadata = sbom.get("metadata", {})
    if metadata.get("authors") is None:
        metadata["authors"] = [AUTHOR]
    if metadata.get("manufacturer") is None:
        metadata["manufacturer"] = MANUFACTURER
    if metadata.get("supplier") is None:
        metadata["supplier"] = SUPPLIER 

    component = metadata.get("component", {})
    if component.get("supplier") is None:
        component["supplier"] = SUPPLIER
    for component in sbom.get("components", []):
        if component.get("supplier") is None:
            component["supplier"] = NOASSERTION


sbom = json.load(sys.stdin)
fix(sbom)
json.dump(sbom, sys.stdout, indent=2)
print(file=sys.stdout)

$ make sbom CYCLONEDX_GOMOD=cyclonedx-gomod CYCLONEDX_GOMOD_FLAGS="-licenses -assert-licenses"
$ ./bom-fix.py <bom.json >sbom.json
$ sbomqs score --profile ntia,ntia-2025 --basic sbom.json
10.0	A	NTIA Minimum Elements (2021)	1.6	json	sbom.json
10.0	A	NTIA Minimum Elements (2025) - RFC	1.6	json	sbom.json

But it is just a hack (even with the proper values), it doesn't add very much?

Finding out the actual "supplier" for each go module is a bigger problem...