tools,build: add CycloneDX SBOM generation

[BethGriggs]

This is a proof-of-concept for build-time SBOM generation in Node.js core (nodejs/security-wg#1115).

The PR adds tools/generate-sbom.py, a stdlib-only Python 3 script that produces a CycloneDX 1.5 JSON Software Bill of Materials covering all bundled runtime dependencies of the Node.js binary.

The script reads config.gypi (produced by ./configure) to determine which dependencies are active in the current build, then extracts version strings from committed C headers, CMakeLists.txt files, package.json files,
and other metadata sources across all deps/ subdirectories. Dependencies disabled via configure flags or satisfied by system libraries are listed with scope: excluded so the document accurately reflects the actual build.

./configure
make sbom       # → out/Release/node-v27.0.0-sbom.json
make test-sbom  # validates the output

Pre-emptive questions

• How much ongoing maintenance does this require?
  • Little. Dep version bumps are picked up automatically from committed headers and package.json files. New JS files in lib/ flow through config.gypi automatically. The only manual step is one DEP_CATALOG entry when a new C/C++ dep is added - a CI test enforces this so a missing entry fails rather than producing a silent gap.
• Why CycloneDX and not SPDX?:
  • npm already ships a CycloneDX 1.5 implementation in deps/npm/lib/utils/sbom-cyclonedx.js. SPDX support could be added later behind a --format flag.
• Why Python and not a Node.js script?:
  • The script runs before node is built. ./configure just needs to have run. Python is already the language of the entire build toolchain (configure.py, gyp_node.py, install.py).
• Why not generate this automatically during make build / make release?
  • Intentionally out of scope for this PR, the idea is that we'd review and iterate before committing to ship it as a release asset.

SBOM snippets

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:17555426-32bc-454a-b766-1a7de082741c",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-15T13:21:37.952127+00:00",
    "lifecycles": [
      {
        "phase": "build"
      }
    ],
    "tools": [
      {
        "vendor": "Node.js",
        "name": "generate_sbom.py",
        "version": "27.0.0"
      }
    ],
    "component": {
      "bom-ref": "nodejs@27.0.0",
      "type": "framework",
      "name": "nodejs",
      "version": "27.0.0",
      "description": "Node.js JavaScript runtime",
      "purl": "pkg:github/nodejs/node@27.0.0"
    },

 ...
 "components": [
    {
      "bom-ref": "openssl@3.5.9",
      "type": "library",
      "name": "openssl",
      "version": "3.5.9",
      "description": "TLS/SSL and general-purpose cryptography library",
      "scope": "required",
      "purl": "pkg:github/openssl/openssl@3.5.9"
    },
    {
      "bom-ref": "zlib@1.3.2.1",
      "type": "library",
      "name": "zlib",
      "version": "1.3.2.1",
      "description": "General-purpose lossless data compression library",
      "scope": "required",
      "purl": "pkg:github/madler/zlib@1.3.2.1"
    },
    ...

[nodejs-github-bot]

Review requested:

• @nodejs/tsc

[marco-ippolito]

Last time I gave it a try I was having an hard time because cyclondx crashed trying to analyze the vendored deps. Glad to see this issue has been fixed

[richardlau]

I think this is good start. It doesn't look like much to maintain (a large part appears to be the catalog).

Maybe in the future we can deduplicate version discovery between the deps_updaters, scanning in https://github.com/nodejs/nodejs-dependency-vuln-assessments and this tool, but certainly doesn't have to happen in the first pass.

[richardlau]

Most of these are not always bundled.
e.g.

• icu could be omitted with configure --with-intl=none
• npm could be omitted with configure --without-npm
• amaro could be omitted with configure --without-amaro
• Rust dependencies could be omitted if configure --v8-disable-temporal-support, or no Rust compiler present

Corepack is no longer bundled by default (but can be included with configure --with-corepack).