SBOM generation and inclusion (#20)

* Add script for generating SBOM

* Add in spdx.json file to python builds

.github/workflows/publish.yml

@@ -22,6 +22,10 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install setuptools wheel twine
+    - name: Generate SBOM
+      run: |
+        pip install cyclonedx-bom
+        ./scripts/make-sbom.sh
     - name: Build and publish
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}

MANIFEST.in

@@ -1,3 +1,4 @@
 include requirements.txt
+include spdx.json
 graft tests
 

scripts/make-sbom.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+cyclonedx-py --e --format json -o cyclonedx-sbom.json
+wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.2/cyclonedx-linux-x64
+chmod u+x cyclonedx-linux-x64
+./cyclonedx-linux-x64 convert --input-format json --output-format spdxjson --input-file cyclonedx-sbom.json --output-file spdx.json