mock-sbom-generator - SBOM Generator plugin and CLI for mock
| Website: | https://github.com/rpm-software-management/mock/ |
|---|---|
| License: | GPL-2.0-or-later |
| Vendor: | Atomicorp, Inc. https://www.atomicorp.com |
- Description:
Mock plugin and standalone CLI that generate a Software Bill of Materials (SBOM) in CycloneDX 1.6 or SPDX 2.3 JSON for packages built with Mock. The SBOM records the build environment, source files, toolchain packages, and resulting RPMs, and is compatible with vulnerability scanners (Grype, Trivy, Snyk, sbom-auditor). This package overlays mock's Python site library with the generator modules and plugin. Enable it with: mock --enable-plugin=sbom_generator
Packages
| mock-sbom-generator-2.0.0-1.fc42.noarch [135 KiB] |
Changelog
by scott@atomicorp.com - 2.0.0-1 (2026-09-11):
- Version 2.0.0: Port mock sbom_generator branch into this overlay RPM - Split monolith into plugin + CLI + library (CycloneDX 1.6 and SPDX 2.3) - Standalone mock-sbom-generator CLI; plugin invokes it at postbuild - Prebuild forensic sbom-prebuild.json and bootstrap-native execution - Map 1.x include_* plugin opts onto CLI flags when command is unset - Requires python3-rpm and python3-distro; python3-specfile recommended |
Package contents (click to display)
[f] /usr/share/man/man1/mock-sbom-generator.1.gz
[f] /usr/share/doc/mock-sbom-generator/Plugin-SBOM.md [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/sbom_generator.py [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_cyclonedx.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_cyclonedx.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_generate.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_generate.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_spdx.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_spdx.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_utils.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/__pycache__/sbom_utils.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/sbom_cyclonedx.py [f] /usr/lib/python3.13/site-packages/mockbuild/sbom_generate.py [f] /usr/lib/python3.13/site-packages/mockbuild/sbom_spdx.py [f] /usr/lib/python3.13/site-packages/mockbuild/sbom_utils.py [f] /usr/bin/mock-sbom-generator |
| mock-sbom-generator-1.1.0-1.fc42.noarch [49 KiB] |
Changelog
by scott@atomicorp.com - 1.1.0-1 (2025-11-26):
- Version 1.1.0: Build hardening metadata and expanded platform support - Added build hardening properties capture (FORTIFY, PIE, RELRO, LTO, FIPS mode) - Capture compiler/linker flags (optflags, hardening_cflags, global_cflags, global_ldflags) - Fixed python3_sitelib macro compatibility for EL8 and EL10 builds - Renamed hardening properties from mock:hardening:* to build:hardening:* for accuracy - Updated property naming to reflect build-time settings vs mock-specific metadata |
Package contents (click to display)
[f] /usr/share/doc/mock-sbom-generator/Plugin-SBOM.md
[f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/sbom_generator.py |
| mock-sbom-generator-1.0.0-2.fc42.noarch [45 KiB] |
Changelog
by scott@atomicorp.com - 1.0-1 (2025-01-20):
- Version 1.0: Enhanced CycloneDX SBOM generation - Added comprehensive metadata.component with license, summary, and URL - Improved primary package detection for multi-package builds - Removed verbose source file properties from package components - Dependencies now only include runtime libraries/RPMs (not source code) - Enhanced RPM metadata in SBOM (buildhost, buildtime, sourcerpm, group, epoch, distribution) |
Package contents (click to display)
[f] /usr/share/doc/mock-sbom-generator/Plugin-SBOM.md
[f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/sbom_generator.py |
| mock-sbom-generator-1.0.0-1.fc42.noarch [49 KiB] |
Changelog
by scott@atomicorp.com - 1.1.0-1 (2025-11-26):
- Version 1.1.0: Build hardening metadata and expanded platform support - Added build hardening properties capture (FORTIFY, PIE, RELRO, LTO, FIPS mode) - Capture compiler/linker flags (optflags, hardening_cflags, global_cflags, global_ldflags) - Fixed python3_sitelib macro compatibility for EL8 and EL10 builds - Renamed hardening properties from mock:hardening:* to build:hardening:* for accuracy - Updated property naming to reflect build-time settings vs mock-specific metadata |
Package contents (click to display)
[f] /usr/share/doc/mock-sbom-generator/Plugin-SBOM.md
[f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.opt-1.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/__pycache__/sbom_generator.cpython-313.pyc [f] /usr/lib/python3.13/site-packages/mockbuild/plugins/sbom_generator.py |