Add SBOM artifact using cyclonedx-gomod

[afbjorklund]

One for lima as a library, one for each cmd.

https://github.com/CycloneDX/cyclonedx-gomod

  app      Generate SBOMs for applications
  bin      Generate SBOMs for binaries
  mod      Generate SBOMs for modules

Closes #5219

Minor license problem with one dependency:

WRN no licenses detected module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e

DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e

i.e. they forgot to say "MIT License" :-)

https://github.com/balajiv113/fd/blob/master/LICENSE.MIT

https://spdx.org/licenses/MIT.html

TODO:

• Use GitHub Actions for installing cyclonedx-gomod, instead of go install? cyclonedx-gomod-generate-sbom
  Using go hack/tools instead.
• The repository’s README file contains a SBOM section that explains where they are published to, format used, etc.
  Published to GitHub Releases.

The scope of this PR is to declare what software source code that went into the compiled binaries:

bom.json (mod)
lima-guestagent.Linux-x86_64.bom.json (app)
limactl-mcp.Linux-x86_64.bom.json (app)
limactl.Linux-x86_64.bom.json (app)

It does not do any files (e.g. checksums) or architectures, and does not cover any external drivers.

---

EDIT: The "app" SBOM actually was per-arch, while the "mod" SBOM is the same for all architectures.

The tool doesn't support cross-compiling, since it needs to be able to run a binary for the OS/ARCH.

[afbjorklund]

Converted to draft, while the scope of sbom is being discussed, and to exclude it from release concerns.

The main shortcomings of the current report is that it doesn't include the "supplier" or the "copyright".

---

NTIA (2021)

SBOM Quality Score: 8.6/10.0 Grade: B Components: 107 EngineVersion: 8 File: bom.json

+------------------------------+--------------------+-----------+--------------------------------+
|           PROFILE            |      FEATURE       |  STATUS   |              DESC              |
+------------------------------+--------------------+-----------+--------------------------------+
| NTIA Minimum Elements (2021) | comp_supplier      | 0.0/10.0  | supplier or manufacturer       |
|                              |                    |           | information missing for all    |
|                              |                    |           | 107 components                 |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_name          | 10.0/10.0 | name declared for all          |
|                              |                    |           | components                     |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_version       | 10.0/10.0 | version declared for all       |
|                              |                    |           | components                     |
+                              +--------------------+-----------+--------------------------------+
|                              | comp_uniq_id       | 10.0/10.0 | unique identifier declared for |
|                              |                    |           | all components (PURL)          |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_relationships | 10.0/10.0 | primary component declares     |
|                              |                    |           | 48 direct (top-level)          |
|                              |                    |           | dependencies                   |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_authors       | 10.0/10.0 | SBOM author inferred from SBOM |
|                              |                    |           | generation tool                |
+                              +--------------------+-----------+--------------------------------+
|                              | sbom_timestamp     | 10.0/10.0 | SBOM creation timestamp        |
|                              |                    |           | declared                       |
+------------------------------+--------------------+-----------+--------------------------------+

Summary:
Required Fields : 6/7 compliant

NTIA (2025)

SBOM Quality Score: 6.9/10.0 Grade: D Components: 107 EngineVersion: 8 File: bom.json

+--------------------------------+----------------------+-----------+-----------------------+
|            PROFILE             |       FEATURE        |  STATUS   |         DESC          |
+--------------------------------+----------------------+-----------+-----------------------+
| NTIA Minimum Elements (2025) - | sbom_machine_format  | 10.0/10.0 | complete              |
| RFC                            |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_author          | 0.0/10.0  | add authors           |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | software_producer    | 0.0/10.0  | add software producer |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_name            | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_version         | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | software_identifiers | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_hash            | 9.9/10.0  | add to 1 component    |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | license              | 0.0/10.0  | add to 107 components |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_dependencies    | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | comp_supplier        | 0.0/10.0  | add to 107 components |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | tool_name            | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | sbom_timestamp       | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+                                +----------------------+-----------+-----------------------+
|                                | generation_context   | 10.0/10.0 | complete              |
|                                |                      |           |                       |
+--------------------------------+----------------------+-----------+-----------------------+

Summary:
Required Fields : 8/13 compliant

---

Any value for the supplier is accepted, so it could be "name: Unknown" etc.

The licenses needs to be asserted (from "evidence"), and 3 licenses added.

WRN no licenses detected module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e
WRN no licenses detected module=github.com/fatih/color@v1.19.0
WRN no licenses detected module=github.com/jinzhu/copier@v0.4.0

The threshold for go-license-detector SPDX is currently hardcoded to 85%.

DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/balajiv113/fd@v0.0.0-20230330094840-143eec500f3e
DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/fatih/color@v1.19.0
DBG detection confidence for license is too low confidence=0.8476821 license=MIT minConfidence=0.85 module=github.com/jinzhu/copier@v0.4.0

Upgrading to github.com/go-enry/go-license-detector/v4 v4.3.1 will fix:

|                                | license              | 9.7/10.0  | add to 3 components   |

[
	{
		"project": "vendor/github.com/balajiv113/fd",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.90066224,
				"file": "LICENSE.MIT"
			}
		]
	},
	{
		"project": "vendor/github.com/fatih/color",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.9096774,
				"file": "LICENSE.md"
			}
		]
	},
	{
		"project": "vendor/github.com/jinzhu/copier",
		"matches": [
			{
				"license": "MIT",
				"confidence": 0.9096774,
				"file": "License"
			}
		]
	}
]

The missing hash on the top component (lima), is another such issue:

|                                | comp_hash            | 9.9/10.0  | add to 1 component    |

                if module.Main {
                        // We currently don't have an accurate way of hashing the main module, as it may contain
                        // files that are .gitignore'd and thus not part of the hashes in Go's sumdb.
                        logger.Debug().Str("module", module.Coordinates()).Msg("not calculating hash for main module")
                        return nil
                }

The new fields sbom_author and software_producer should be simple:

metadata.(authors/author) "The person(s) who created the BOM."

Authors are common in BOMs created through manual processes.
BOMs created through automated means may have @.manufacturer instead.

metadata.(supplier/manufacturer) "The organization that created the BOM."

The organization that supplied the component that the BOM describes.
The supplier may often be the manufacturer, but may also be a distributor or repackager.

https://cyclonedx.org/docs/1.6/json/

[afbjorklund]

Here's the hack to get a perfect score with sbomqs, adding the missing fields:

#!/usr/bin/env python3

import sys
import json

# organizationalContact
AUTHOR = {"name": "Unknown", "email": "unknown@example.com"}

# organizationalEntity
MANUFACTURER = {"name": "Unknown", "url": ["https://example.com"]}

# organizationalEntity
SUPPLIER = {"name": "Unknown"}

# organizationalEntity
NOASSERTION = {"name": "Unknown"}


def fix(sbom):
    metadata = sbom.get("metadata", {})
    if metadata.get("authors") is None:
        metadata["authors"] = [AUTHOR]
    if metadata.get("manufacturer") is None:
        metadata["manufacturer"] = MANUFACTURER
    if metadata.get("supplier") is None:
        metadata["supplier"] = SUPPLIER 

    component = metadata.get("component", {})
    if component.get("supplier") is None:
        component["supplier"] = SUPPLIER
    for component in sbom.get("components", []):
        if component.get("supplier") is None:
            component["supplier"] = NOASSERTION


sbom = json.load(sys.stdin)
fix(sbom)
json.dump(sbom, sys.stdout, indent=2)
print(file=sys.stdout)

$ make sbom CYCLONEDX_GOMOD=cyclonedx-gomod CYCLONEDX_GOMOD_FLAGS="-licenses -assert-licenses"
$ ./bom-fix.py <bom.json >sbom.json
$ sbomqs score --profile ntia,ntia-2025 --basic sbom.json
10.0	A	NTIA Minimum Elements (2021)	1.6	json	sbom.json
10.0	A	NTIA Minimum Elements (2025) - RFC	1.6	json	sbom.json

But it is just a hack (even with the proper values), it doesn't add very much?

Finding out the actual "supplier" for each go module is a bigger problem...

[AkihiroSuda]

Please tidy up the commits

[afbjorklund]

We can leave this feature out of 2.3.0 if needed, it can be recreated from the go.mod (and mods)

That is, the bom.json does not really include any information that is not in "go.mod" and "vendor".

[afbjorklund]

I am leaving the lima hash as undefined (it does record the tag, but commit is currently broken*)
* due to a bug in the tool, since it records the version of non-releases as the tag instead of HEAD...

e.g. v2.1.5-0.20260702235736-5f0456df6167 where it was supposed to use the current commit:
i.e. v2.1.5-0.20260713194131-434881e3c48b (and it is also not reporting the full commit SHA-1)

Should not matter for release versions, where the commit is the tag. And the "hash" is undefined.

The current consensus is that the SHA-256 of the Source code .tar.gz should be used, for the root.

But currently we are not recording that anywhere, not in the Releases and not in the SHA256SUMS:

cdba3804df7d8c00a2af674a3fe0b24c19673a0e846e5f75ac9badf227ce52f5  lima-2.2.0.tar.gz

---

The 2.1.5 is another bug in the tool, it uses the latest tag - not necessarily the one in the branch
So it picks "2.1.4" instead of "2.2.0", even though the master branch does not contain any 2.1.4.

Again it should not matter for the release, since the current tag will be the most recent created.
But it seems that most of the cyclonedx-gomod git code is broken, and will need some patching.

[afbjorklund]

I added a separate issue for the missing hash of the top-level component:

• Add checksum of the source code tarball to the SHA256SUMS #5414