Generate a SBOM for the Enterprise image

.github/workflows/ci.yml

@@ -31,6 +31,14 @@ jobs:
 
       - run: make docker PRESET=Release ${{ matrix.edition.options }}
 
+      - name: SBOM (Enterprise)
+        run: |
+          node ./enterprise/scripts/sbom.js one /tmp/sbom.spdx.json
+          cat /tmp/sbom.spdx.json
+          npx --yes @sourcemeta/jsonschema validate \
+            vendor/spdx/schemas/spdx-schema.json /tmp/sbom.spdx.json --verbose
+        if: matrix.edition.name == 'enterprise'
+
       - name: Sandbox (headless)
         uses: ./.github/actions/sandbox
         with:

.github/workflows/deploy.yml

@@ -167,12 +167,23 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository_owner }}/one-enterprise
 
+      - run: >
+          node ./enterprise/scripts/sbom.js
+          "ghcr.io/${{ github.repository_owner }}/one-enterprise:${{ steps.meta.outputs.version }}"
+          /tmp/sbom.spdx.json
+
+      - run: >
+          npx --yes @sourcemeta/jsonschema validate
+          vendor/spdx/schemas/spdx-schema.json
+          /tmp/sbom.spdx.json --verbose
+
       - run: >
           ./enterprise/scripts/cosign.sh
           "ghcr.io/${{ github.repository_owner }}/one-enterprise"
           "${{ steps.meta.outputs.version }}"
           "https://token.actions.githubusercontent.com"
           "https://github.com/${{ github.repository }}/.github/workflows/deploy.yml@${{ github.ref }}"
+          "/tmp/sbom.spdx.json"
 
   release:
     needs: docker-multi-arch

DEPENDENCIES

@@ -9,6 +9,7 @@ jsonschema https://github.com/sourcemeta/jsonschema v14.13.4
 bootstrap https://github.com/twbs/bootstrap v5.3.3
 bootstrap-icons https://github.com/twbs/icons v1.11.3
 collections/sourcemeta/std/v0 https://github.com/sourcemeta/std v0.4.0
+spdx https://github.com/spdx/spdx-spec v2.3
 public/modelcontextprotocol https://github.com/modelcontextprotocol/modelcontextprotocol 2025-11-25
 public/a2a/v0.3.0 https://github.com/a2aproject/A2A v0.3.0
 public/a2a/v0.2.6 https://github.com/a2aproject/A2A v0.2.6

enterprise/scripts/cosign.sh

@@ -3,16 +3,17 @@
 set -o errexit
 set -o nounset
 
-if [ "$#" -ne 4 ]
+if [ "$#" -ne 5 ]
 then
-  echo "Usage: $0 <image> <version> <certificate-oidc-issuer> <certificate-identity>" 1>&2
+  echo "Usage: $0 <image> <version> <certificate-oidc-issuer> <certificate-identity> <sbom-file>" 1>&2
   exit 1
 fi
 
 IMAGE="$1"
 VERSION="$2"
 CERTIFICATE_OIDC_ISSUER="$3"
 CERTIFICATE_IDENTITY="$4"
+SBOM_FILE="$5"
 
 echo "Cosign: Extracting manifest digest for ${IMAGE}:${VERSION}" 1>&2
 MANIFEST=$(docker buildx imagetools inspect "${IMAGE}:${VERSION}" \
@@ -28,6 +29,9 @@ echo "Cosign: Manifest digest is ${DIGEST}" 1>&2
 echo "Cosign: Signing ${IMAGE}@${DIGEST}" 1>&2
 cosign sign --yes "${IMAGE}@${DIGEST}"
 
+echo "Cosign: Attaching SBOM attestation to ${IMAGE}@${DIGEST}" 1>&2
+cosign attest --yes --predicate "$SBOM_FILE" --type spdx "${IMAGE}@${DIGEST}"
+
 echo "Cosign: Verifying signature for ${IMAGE}@${DIGEST}" 1>&2
 echo "Cosign: OIDC issuer: ${CERTIFICATE_OIDC_ISSUER}" 1>&2
 echo "Cosign: Certificate identity: ${CERTIFICATE_IDENTITY}" 1>&2
@@ -37,3 +41,11 @@ cosign verify \
   "${IMAGE}@${DIGEST}"
 
 echo "Cosign: Signature verified successfully" 1>&2
+
+echo "Cosign: Verifying SBOM attestation for ${IMAGE}@${DIGEST}" 1>&2
+cosign verify-attestation --type spdx \
+  --certificate-oidc-issuer "$CERTIFICATE_OIDC_ISSUER" \
+  --certificate-identity "$CERTIFICATE_IDENTITY" \
+  "${IMAGE}@${DIGEST}"
+
+echo "Cosign: SBOM attestation verified successfully" 1>&2

enterprise/scripts/sbom-vendorpull.js

@@ -1,8 +1,5 @@
 #!/usr/bin/env node
 
-// Generates an SPDX 2.3 JSON Software Bill of Materials (SBOM) for the
-// vendored C++ and frontend dependencies managed through DEPENDENCIES files
-
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";

enterprise/scripts/sbom.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+
+import { readFileSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { execSync } from "node:child_process";
+import { tmpdir } from "node:os";
+
+const image = process.argv[2];
+const output = process.argv[3];
+if (!image || !output) {
+  process.stderr.write(`Usage: ${process.argv[1]} <image> <output>\n`);
+  process.exit(1);
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sbom-"));
+try {
+  try {
+    execSync(`docker image inspect ${image}`, { stdio: "ignore" });
+  } catch {
+    execSync(`docker pull ${image}`, { stdio: [ "ignore", "inherit", "inherit" ] });
+  }
+
+  const container = execSync(`docker create ${image}`, { encoding: "utf-8" }).trim();
+  execSync(`docker cp ${container}:/usr/share/sourcemeta/one/npm-packages.spdx.json ${workdir}/npm.json`);
+  execSync(`docker cp ${container}:/usr/share/sourcemeta/one/vendor-packages.spdx.json ${workdir}/vendor.json`);
+  execSync(`docker cp ${container}:/usr/share/sourcemeta/one/dpkg-packages ${workdir}/dpkg-packages`);
+  execSync(`docker rm ${container}`, { stdio: "ignore" });
+
+  const npm = JSON.parse(readFileSync(join(workdir, "npm.json"), "utf-8"));
+  const vendor = JSON.parse(readFileSync(join(workdir, "vendor.json"), "utf-8"));
+  const dpkg = readFileSync(join(workdir, "dpkg-packages"), "utf-8");
+
+  const version = vendor.packages
+    .find((entry) => entry.SPDXID === "SPDXRef-RootPackage").versionInfo;
+
+  const packages = [{
+    name: "sourcemeta-one-enterprise",
+    SPDXID: "SPDXRef-RootPackage",
+    versionInfo: version,
+    downloadLocation: "https://github.com/sourcemeta/one",
+    filesAnalyzed: false,
+    licenseConcluded: "NOASSERTION",
+    licenseDeclared: "NOASSERTION"
+  }];
+
+  const relationships = [{
+    spdxElementId: "SPDXRef-DOCUMENT",
+    relationshipType: "DESCRIBES",
+    relatedSpdxElement: "SPDXRef-RootPackage"
+  }];
+
+  let index = 0;
+
+  for (const entry of vendor.packages) {
+    if (entry.SPDXID === "SPDXRef-RootPackage") continue;
+    index += 1;
+    const spdxid = `SPDXRef-Vendor-${index}`;
+    packages.push({ ...entry, SPDXID: spdxid });
+    relationships.push({
+      spdxElementId: "SPDXRef-RootPackage",
+      relationshipType: "DEPENDS_ON",
+      relatedSpdxElement: spdxid
+    });
+  }
+
+  for (const entry of npm.packages || []) {
+    if (entry.SPDXID === "SPDXRef-RootPackage") continue;
+    index += 1;
+    const spdxid = `SPDXRef-Npm-${index}`;
+    packages.push({ ...entry, SPDXID: spdxid });
+    relationships.push({
+      spdxElementId: "SPDXRef-RootPackage",
+      relationshipType: "DEPENDS_ON",
+      relatedSpdxElement: spdxid
+    });
+  }
+
+  for (const line of dpkg.split("\n")) {
+    if (!line.trim()) continue;
+    const [name, entryVersion, homepage] = line.split("\t");
+    index += 1;
+    const spdxid = `SPDXRef-Dpkg-${index}`;
+    packages.push({
+      name,
+      SPDXID: spdxid,
+      versionInfo: entryVersion,
+      downloadLocation: homepage || "NOASSERTION",
+      filesAnalyzed: false,
+      licenseConcluded: "NOASSERTION",
+      licenseDeclared: "NOASSERTION"
+    });
+    relationships.push({
+      spdxElementId: "SPDXRef-RootPackage",
+      relationshipType: "DEPENDS_ON",
+      relatedSpdxElement: spdxid
+    });
+  }
+
+  writeFileSync(output, JSON.stringify({
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: "sourcemeta-one-enterprise",
+    documentNamespace: `https://one.sourcemeta.com/sbom/${version}`,
+    creationInfo: {
+      created: new Date().toISOString(),
+      creators: [ "Tool: enterprise/scripts/sbom.js" ]
+    },
+    packages,
+    relationships
+  }, null, 2) + "\n");
+} finally {
+  rmSync(workdir, { recursive: true, force: true });
+}