@@ -18,6 +18,25 @@ FUNCTION (EXTRACT_REPO_NAME_AND_USER repo_url repo_name_var repo_user_var)
1818 SET (${repo_user_var} ${repo_user} PARENT_SCOPE )
1919ENDFUNCTION ()
2020
21+ # Extract a valid RFC 5322 email address out of CPACK_PACKAGE_CONTACT.
22+ # CPACK_PACKAGE_CONTACT is normally in the "Display Name <email@domain>" form,
23+ # but a bare "email@domain" is also accepted. FATAL_ERROR if no valid email
24+ # can be found, since the SBOM schema requires the author's email to be a
25+ # real address.
26+ FUNCTION (SBOM_GET_CONTACT_EMAIL varname )
27+ SET (email_regex "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\ .[A-Za-z]+$" )
28+ STRING (REGEX MATCH "<([^>]+)>" bracketed "${CPACK_PACKAGE_CONTACT} " )
29+ IF (bracketed)
30+ SET (email "${CMAKE_MATCH_1} " )
31+ ELSE ()
32+ SET (email "${CPACK_PACKAGE_CONTACT} " )
33+ ENDIF ()
34+ IF (NOT email MATCHES "${email_regex} " )
35+ MESSAGE (FATAL_ERROR "CPACK_PACKAGE_CONTACT ('${CPACK_PACKAGE_CONTACT} ') does not contain a valid email address" )
36+ ENDIF ()
37+ SET (${varname} "${email} " PARENT_SCOPE )
38+ ENDFUNCTION ()
39+
2140# Add a known 3rd party dependency for SBOM generation
2241# Currently used for "vendored" (part of our repository) source code we know about
2342# such as zlib, as well ExternalProject_Add() projects
@@ -303,7 +322,8 @@ FUNCTION(GENERATE_SBOM)
303322 STRING (APPEND reflist ",\n {\" ref\" : \" ${bom_ref} \" }" )
304323 ENDFOREACH ()
305324 STRING (APPEND sbom_dependencies "\n ]\n }${reflist} \n " )
306- STRING (UUID UUID NAMESPACE ee390ca3-e70f-4b35-808e-a512489156f5 NAME SBOM TYPE SHA1 )
325+ STRING (RANDOM LENGTH 20 rnd)
326+ STRING (UUID UUID NAMESPACE ee390ca3-e70f-4b35-808e-a512489156f5 NAME SBOM-${rnd} TYPE SHA1 )
307327 STRING (TIMESTAMP TIMESTAMP "%Y-%m-%dT%H:%M:%SZ" UTC )
308328 EXTRACT_REPO_NAME_AND_USER ("${GIT_REMOTE_ORIGIN_URL} " GITHUB_REPO_NAME GITHUB_REPO_USER )
309329 #github-purl needs lowercased user and project names
@@ -313,5 +333,6 @@ FUNCTION(GENERATE_SBOM)
313333 SET (CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR} .${CPACK_PACKAGE_VERSION_MINOR} .${CPACK_PACKAGE_VERSION_PATCH} " )
314334 ENDIF ()
315335 STRING (TIMESTAMP CURRENT_YEAR "%Y" )
336+ SBOM_GET_CONTACT_EMAIL (SBOM_AUTHOR_EMAIL )
316337 configure_file (${CMAKE_CURRENT_LIST_DIR } /cmake/sbom.json.in ${CMAKE_BINARY_DIR } /sbom.json )
317338ENDFUNCTION ()
0 commit comments