Generate software bill of materials as part of the package builds. #3702

pkg/mac/build-functions.sh

@@ -320,6 +320,11 @@ _complete_bundle() {
     chmod -R og-w "${BUNDLE_DIR}"
 }
 
+_generate_sbom() {
+   echo "Generating SBOM..."
+   syft "${BUNDLE_DIR}/Contents/" -o cyclonedx-json > "${BUNDLE_DIR}/Contents/cyclonedx.json"
+}
+
 _codesign_binaries() {
     if [ "${CODESIGN}" -eq 0 ]; then
         return
@@ -485,4 +490,4 @@ _notarize_pkg() {
     fi
 
     echo "Notarization completed successfully."
-}
+}

pkg/mac/build.sh

@@ -66,6 +66,7 @@ _build_runtime
 _create_python_env
 _build_docs
 _complete_bundle
+_generate_sbom
 _codesign_binaries
 _codesign_bundle
 _create_dmg