From 3093c38ab8c314ee8c6624955b305a85c8a8d0b7 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Wed, 25 Mar 2026 09:56:38 +0200 Subject: [PATCH] Generate SBOM info WE2-1144 Signed-off-by: Raul Metsma --- .github/workflows/cmake-linux-fedora.yml | 8 +- .github/workflows/cmake-linux-ubuntu.yml | 5 +- .github/workflows/cmake-macos.yml | 7 + .github/workflows/cmake-windows.yml | 8 ++ .gitmodules | 4 + CMakeLists.txt | 1 + cmake/cmake-sbom | 1 + cmake/sbom.cmake | 151 ++++++++++++++++++++++ src/app/CMakeLists.txt | 2 +- src/controller/CMakeLists.txt | 1 - src/controller/utils/qdisablecopymove.hpp | 13 -- src/ui/certificatewidget.hpp | 1 - src/ui/webeiddialog.hpp | 1 - 13 files changed, 183 insertions(+), 20 deletions(-) create mode 160000 cmake/cmake-sbom create mode 100644 cmake/sbom.cmake delete mode 100644 src/controller/utils/qdisablecopymove.hpp diff --git a/.github/workflows/cmake-linux-fedora.yml b/.github/workflows/cmake-linux-fedora.yml index 83b23886..2a7c9f1b 100644 --- a/.github/workflows/cmake-linux-fedora.yml +++ b/.github/workflows/cmake-linux-fedora.yml @@ -39,9 +39,13 @@ jobs: run: cmake -DCMAKE_BUILD_TYPE=$BUILD_TYPE -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_INSTALL_SYSCONFDIR=/etc -B build -S . - name: Build - run: cmake --build build --config $BUILD_TYPE --target package + run: | + cmake --build build --config $BUILD_TYPE --target package + cmake --install build/sbom - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: web-eid-app-fedora-build-fedora${{matrix.container}}-${{github.run_number}} - path: build/*rpm + path: | + build/*rpm + build/*.spdx \ No newline at end of file diff --git a/.github/workflows/cmake-linux-ubuntu.yml b/.github/workflows/cmake-linux-ubuntu.yml index 9820219b..b6f2f96a 100644 --- a/.github/workflows/cmake-linux-ubuntu.yml +++ b/.github/workflows/cmake-linux-ubuntu.yml @@ -52,6 +52,7 @@ jobs: - name: Build run: | cmake --build build --config $BUILD_TYPE --target installer + cmake --install build/sbom # Debian creates artifacts outside of project dir, copy them back to make them available in the build artifacts mv ../web-eid*.* build/ @@ -61,4 +62,6 @@ jobs: - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: web-eid-app-ubuntu-build-ubuntu${{matrix.container}}-${{ matrix.arch }}-${{github.run_number}} - path: build/*.*deb + path: | + build/*.*deb + build/*.spdx diff --git a/.github/workflows/cmake-macos.yml b/.github/workflows/cmake-macos.yml index b1180c69..b375b84e 100644 --- a/.github/workflows/cmake-macos.yml +++ b/.github/workflows/cmake-macos.yml @@ -61,6 +61,7 @@ jobs: cmake --build ${BUILD_DIR} --config ${BUILD_TYPE} cmake --build ${BUILD_DIR} --config ${BUILD_TYPE} --target installer cmake --build ${BUILD_DIR} --config ${BUILD_TYPE} --target installer-safari + cmake --install build/sbom - name: Test run: ctest -V -C ${BUILD_TYPE} --test-dir ${BUILD_DIR} @@ -72,3 +73,9 @@ jobs: path: | build/src/app/*.pkg build/src/app/*.dmg + + - name: Upload SBOM artifacts + uses: actions/upload-artifact@v7 + with: + name: web-eid-app-macos-sbom-${{github.run_number}} + path: build/*.spdx \ No newline at end of file diff --git a/.github/workflows/cmake-windows.yml b/.github/workflows/cmake-windows.yml index f9b1c0df..a0aa27e3 100644 --- a/.github/workflows/cmake-windows.yml +++ b/.github/workflows/cmake-windows.yml @@ -64,6 +64,8 @@ jobs: VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg_cache,readwrite run: | .\build.ps1 -vcpkgroot C:\vcpkg -qt_dir $env:QT_DIR -acceptWixEULA + cmake --install build/x64/sbom + cmake --install build/arm64/sbom - name: Test shell: pwsh @@ -79,6 +81,12 @@ jobs: build\x64\src\app\**\*.msi build\arm64\src\app\**\*.msi + - name: Upload SBOM artifacts + uses: actions/upload-artifact@v7 + with: + name: web-eid-app-windows-sbom-${{matrix.arch}}-${{github.run_number}} + path: build/*.spdx + - name: Upload debug artifacts uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: diff --git a/.gitmodules b/.gitmodules index 6cc15ae0..124000fd 100644 --- a/.gitmodules +++ b/.gitmodules @@ -4,3 +4,7 @@ [submodule "src/mac/js"] path = src/mac/js url = ../web-eid-webextension +[submodule "cmake/cmake-sbom"] + path = cmake/cmake-sbom + url = https://github.com/DEMCON/cmake-sbom.git + branch = v1.4.0 diff --git a/CMakeLists.txt b/CMakeLists.txt index dfa0f2e8..83edf409 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -55,3 +55,4 @@ endif() enable_testing() add_subdirectory(tests/mock-ui) add_subdirectory(tests/tests) +include(cmake/sbom.cmake) diff --git a/cmake/cmake-sbom b/cmake/cmake-sbom new file mode 160000 index 00000000..9cf1ba43 --- /dev/null +++ b/cmake/cmake-sbom @@ -0,0 +1 @@ +Subproject commit 9cf1ba4339d793d29246bf0abe2576b322c05981 diff --git a/cmake/sbom.cmake b/cmake/sbom.cmake new file mode 100644 index 00000000..3ce3a80b --- /dev/null +++ b/cmake/sbom.cmake @@ -0,0 +1,151 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + +# SBOM generation using DEMCON/cmake-sbom (SPDX 2.3, install-time) +# Run: cmake --install /sbom + +list(APPEND CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake/cmake-sbom/cmake") +include(sbom) + +execute_process( + COMMAND git describe --tags --abbrev=0 + WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}/lib/libelectronic-id" + OUTPUT_VARIABLE ELECTRONIC_ID_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE + ERROR_QUIET +) +string(REGEX REPLACE "^v" "" ELECTRONIC_ID_VERSION "${ELECTRONIC_ID_VERSION}") + +sbom_generate( + OUTPUT "${CMAKE_BINARY_DIR}/web-eid-${PROJECT_VERSION}.spdx" + LICENSE "MIT" + SUPPLIER "Estonian Information System Authority" + SUPPLIER_URL https://www.ria.ee + DOWNLOAD_URL https://github.com/web-eid/web-eid-app + VERSION "${PROJECT_VERSION}" +) + +set(_sbom_reset "${CMAKE_BINARY_DIR}/sbom/sbom-reset.cmake") +file(WRITE "${_sbom_reset}" + "file(WRITE \"${CMAKE_BINARY_DIR}/sbom/sbom.spdx.in\" \"\")\n" + "file(READ \"${CMAKE_BINARY_DIR}/SPDXRef-DOCUMENT.spdx.in\" _doc)\n" + "file(APPEND \"${CMAKE_BINARY_DIR}/sbom/sbom.spdx.in\" \"\${_doc}\")\n" + "set(SBOM_VERIFICATION_CODES \"\")\n" +) +file(APPEND "${CMAKE_BINARY_DIR}/sbom/CMakeLists.txt" + "install(SCRIPT \"${_sbom_reset}\")\n" +) + +set(_app_spdxid "SPDXRef-Package-${PROJECT_NAME} DEPENDS_ON @SBOM_LAST_SPDXID@") +if(APPLE) + sbom_add(PACKAGE web-eid-safari + VERSION "${PROJECT_VERSION}" + SUPPLIER "Organization: Estonian Information System Authority" + DOWNLOAD_LOCATION https://github.com/web-eid/web-eid-app + LICENSE "MIT" + EXTREF "cpe:2.3:a:web-eid:web-eid:${PROJECT_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "@SBOM_LAST_SPDXID@ VARIANT_OF SPDXRef-Package-${PROJECT_NAME}" + ) + set(_app_spdxid "${_app_spdxid}\nRelationship: ${SBOM_LAST_SPDXID} DEPENDS_ON @SBOM_LAST_SPDXID@") + file(READ "${CMAKE_SOURCE_DIR}/src/mac/js/package.json" _webext_json) + string(JSON WEBEXT_VERSION GET "${_webext_json}" "version") + sbom_add(PACKAGE web-eid-webextension + VERSION "${WEBEXT_VERSION}" + SUPPLIER "Organization: Estonian Information System Authority" + DOWNLOAD_LOCATION https://github.com/web-eid/web-eid-webextension + LICENSE "MIT" + RELATIONSHIP "${SBOM_LAST_SPDXID} DEPENDS_ON @SBOM_LAST_SPDXID@" + ) + if(NPM_EXECUTABLE) + execute_process( + COMMAND "${NPM_EXECUTABLE}" --version + OUTPUT_VARIABLE NPM_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE + ERROR_QUIET + ) + string(REGEX REPLACE "^v" "" NPM_VERSION "${NPM_VERSION}") + endif() + if(NPM_VERSION) + sbom_add(PACKAGE npm + VERSION "${NPM_VERSION}" + SUPPLIER "Organization: OpenJS Foundation" + DOWNLOAD_LOCATION https://www.npmjs.com + LICENSE "Artistic-2.0" + EXTREF "cpe:2.3:a:npmjs:npm:${NPM_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "@SBOM_LAST_SPDXID@ BUILD_TOOL_OF ${SBOM_LAST_SPDXID}" + ) + endif() +endif() + +if(WIN32) + find_program(WIX_EXECUTABLE NAMES wix) + if(WIX_EXECUTABLE) + execute_process( + COMMAND "${WIX_EXECUTABLE}" --version + OUTPUT_VARIABLE WIX_VERSION + OUTPUT_STRIP_TRAILING_WHITESPACE + ERROR_QUIET + ) + string(REGEX REPLACE "\\+.*$" "" WIX_VERSION "${WIX_VERSION}") + endif() + if(WIX_VERSION) + sbom_add(PACKAGE WiX + VERSION "${WIX_VERSION}" + SUPPLIER "Organization: WiX Toolset Contributors" + DOWNLOAD_LOCATION https://wixtoolset.org + LICENSE "MS-RL" + EXTREF "cpe:2.3:a:wixtoolset:wix_toolset:${WIX_VERSION}:*:*:*:*:*:*:*" + ) + endif() +endif() + +sbom_add(PACKAGE libelectronic-id + VERSION "${ELECTRONIC_ID_VERSION}" + SUPPLIER "Organization: Estonian Information System Authority" + DOWNLOAD_LOCATION https://github.com/web-eid/libelectronic-id + LICENSE "MIT" + EXTREF "cpe:2.3:a:web-eid:libelectronic-id:${ELECTRONIC_ID_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "${_app_spdxid}" +) + +find_package(GTest QUIET) +if(GTest_FOUND) + sbom_add(PACKAGE GTest + VERSION "${GTest_VERSION}" + SUPPLIER "Organization: Google LLC" + DOWNLOAD_LOCATION https://github.com/google/googletest + LICENSE "BSD-3-Clause" + EXTREF "cpe:2.3:a:google:googletest:${GTest_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "${SBOM_LAST_SPDXID} TEST_TOOL_OF @SBOM_LAST_SPDXID@" + ) +endif() + +if(PCSC_FOUND) + sbom_add(PACKAGE libpcsclite + VERSION "${PCSC_VERSION}" + SUPPLIER "Organization: Muscle project" + DOWNLOAD_LOCATION https://pcsclite.apdu.fr + LICENSE "BSD-3-Clause" + EXTREF "cpe:2.3:a:pcsc-lite_project:pcsc-lite:${PCSC_VERSION}:*:*:*:*:*:*:*" + ) +endif() + +sbom_add(PACKAGE Qt6 + VERSION "${Qt6_VERSION}" + SUPPLIER "Organization: The Qt Company" + DOWNLOAD_LOCATION https://download.qt.io/ + LICENSE "LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only OR LicenseRef-Qt-commercial" + EXTREF "cpe:2.3:a:qt:qt:${Qt6_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "${_app_spdxid}" +) + +sbom_add(PACKAGE OpenSSL + VERSION "${OPENSSL_VERSION}" + SUPPLIER "Organization: OpenSSL Software Foundation" + DOWNLOAD_LOCATION https://openssl.org + LICENSE "Apache-2.0" + EXTREF "cpe:2.3:a:openssl:openssl:${OPENSSL_VERSION}:*:*:*:*:*:*:*" + RELATIONSHIP "${_app_spdxid}" +) + +sbom_finalize(NO_VERIFY) diff --git a/src/app/CMakeLists.txt b/src/app/CMakeLists.txt index 676d3f56..1582485d 100644 --- a/src/app/CMakeLists.txt +++ b/src/app/CMakeLists.txt @@ -25,7 +25,7 @@ if(WIN32) endif() set(WEBEID_PATH web-eid.exe) set(BASE_FILE $_${PROJECT_VERSION}.$ENV{PLATFORM}) - set(WIX_CMD wix.exe build -nologo + set(WIX_CMD wix build -nologo -arch $ENV{PLATFORM} -ext WixToolset.UI.wixext -bv WixUIDialogBmp=${CMAKE_SOURCE_DIR}/install/dlgbmp.bmp diff --git a/src/controller/CMakeLists.txt b/src/controller/CMakeLists.txt index 80e24e7a..12a8d6ae 100644 --- a/src/controller/CMakeLists.txt +++ b/src/controller/CMakeLists.txt @@ -35,7 +35,6 @@ add_library(controller STATIC ui.hpp utils/erasedata.hpp utils/observer_ptr.hpp - utils/qdisablecopymove.hpp utils/qt_comp.hpp utils/utils.hpp writeresponse.cpp diff --git a/src/controller/utils/qdisablecopymove.hpp b/src/controller/utils/qdisablecopymove.hpp deleted file mode 100644 index 09f81262..00000000 --- a/src/controller/utils/qdisablecopymove.hpp +++ /dev/null @@ -1,13 +0,0 @@ -// SPDX-FileCopyrightText: Estonian Information System Authority -// SPDX-License-Identifier: MIT - -#pragma once - -// Q_DISABLE_COPY_MOVE is available since Qt 5.13, define it for earlier versions. -// Assumes that Qt headers are already included. -#ifndef Q_DISABLE_COPY_MOVE -#define Q_DISABLE_COPY_MOVE(Class) \ - Q_DISABLE_COPY(Class) \ - Class(Class&&) = delete; \ - Class& operator=(Class&&) = delete; -#endif diff --git a/src/ui/certificatewidget.hpp b/src/ui/certificatewidget.hpp index ba71493d..9d3a205b 100644 --- a/src/ui/certificatewidget.hpp +++ b/src/ui/certificatewidget.hpp @@ -6,7 +6,6 @@ #include #include "certandpininfo.hpp" -#include "utils/qdisablecopymove.hpp" class QLabel; diff --git a/src/ui/webeiddialog.hpp b/src/ui/webeiddialog.hpp index 00e4f0eb..f9a6d18b 100644 --- a/src/ui/webeiddialog.hpp +++ b/src/ui/webeiddialog.hpp @@ -4,7 +4,6 @@ #pragma once #include "ui.hpp" -#include "utils/qdisablecopymove.hpp" #include