Sign the generated BOMs

Signed-off-by: Prabhu Subramanian <[email protected]>

Author: prabhu

bin/cdxgen.js

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
-
+import { Buffer } from "node:buffer";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import process from "node:process";
-import { URL } from "node:url";
 import { findUpSync } from "find-up";
 import globalAgent from "global-agent";
 import { load as _load } from "js-yaml";
@@ -781,6 +780,13 @@ const checkPermissions = (filePath, options) => {
   return true;
 };
 
+const needsBomSigning = ({ generateKeyAndSign }) =>
+  generateKeyAndSign ||
+  (process.env.SBOM_SIGN_ALGORITHM &&
+    process.env.SBOM_SIGN_ALGORITHM !== "none" &&
+    process.env.SBOM_SIGN_PRIVATE_KEY &&
+    safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY));
+
 /**
  * Method to start the bom creation process
  */
@@ -838,14 +844,7 @@ const checkPermissions = (filePath, options) => {
           thoughtLog(`Let's save the file to "${jsonFile}".`);
         }
       }
-      if (
-        jsonPayload &&
-        (options.generateKeyAndSign ||
-          (process.env.SBOM_SIGN_ALGORITHM &&
-            process.env.SBOM_SIGN_ALGORITHM !== "none" &&
-            process.env.SBOM_SIGN_PRIVATE_KEY &&
-            safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY)))
-      ) {
+      if (jsonPayload && needsBomSigning(options)) {
         let alg = process.env.SBOM_SIGN_ALGORITHM || "RS512";
         if (alg.includes("none")) {
           alg = "RS512";
@@ -857,6 +856,7 @@ const checkPermissions = (filePath, options) => {
           const jdirName = dirname(jsonFile);
           publicKeyFile = join(jdirName, "public.key");
           const privateKeyFile = join(jdirName, "private.key");
+          const privateKeyB64File = join(jdirName, "private.key.base64");
           const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
             modulusLength: 4096,
             publicKeyEncoding: {
@@ -870,10 +870,15 @@ const checkPermissions = (filePath, options) => {
           });
           fs.writeFileSync(publicKeyFile, publicKey);
           fs.writeFileSync(privateKeyFile, privateKey);
+          fs.writeFileSync(
+            privateKeyB64File,
+            Buffer.from(privateKey, "utf8").toString("base64"),
+          );
           console.log(
             "Created public/private key pairs for testing purposes",
             publicKeyFile,
             privateKeyFile,
+            privateKeyB64File,
           );
           privateKeyToUse = privateKey;
           jwkPublicKey = crypto

contrib/bom-signer/public.key

@@ -1,14 +1,14 @@
 -----BEGIN PUBLIC KEY-----
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtcQyHqd3UHoZixi/cRTs
-bdrsBpf31aGlcsRF6hfnFRSw2JvSI//JzAngheVymIbq+KNHI31t7oR6oOHqORap
-FlIgRhR03ftNMzi0+VpRR8ztWha5eU7+7eDV3QsRVePninVr3MxzOczprEdqcOuO
-CAlflRjw67FoRLMZCJBRbRNbw95GBhBdsHCfbPSMA+5xhiPywYOc3Z1D+k8s3dBh
-42kjCNBl3RwCNsocW1eTcEIFV+sZfVxT3kOwZ+EN9BfU6mcBW8eFMLtTzmT9wdpY
-r6CEE+eaCpbi7X/rD674WdDa5QaOUO/Bu/mnuRlQ7tAP9/jAVOidVvkLWMXuIpMB
-w/YEDgGa6qeVikrQmZdkMF3vaLmnXcRtgfUd7PmTp3K9yjEajP6CtNbfIigz4yWD
-KGp6nYalW1Bl3w+qKNmGWCVqjE6RlktxaZYJlXuA0l9RWL/YMtTxOvf+s+4GQru0
-T3RMZfpSS2V1dRBwllEaDI5lupmqUpuX2wHAFRKAKAXh4DAcg+sR5UXzXOxzfuxf
-Rt0AtbaoWFALUR6BpwJW1fcaBCYAakNe6aZgdWCa7lldI6fepyEq5wiyjE+7W5xm
-r+irUPeENIDvz4Tf8GWJ8CELT7VkZaY4SntcXhi+HF4Yk+n+ziESj/ZO+7r3A9mF
-H6fu+s5F5YkZESJ3FGkKt1MCAwEAAQ==
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkPc49A6w2obDpm29JKc8
+r3iWn8eyujTF9bBwe2Y265GRvEENvdU1/7r2w2pU3xFF7AXOZZPWO3FBxLZZ5ZLr
+8SCdLjI7XibkA1qxPgH+nE2p8HB3V4SROyOhl37jedvLyUr9oWMGn+cdj8p9D4mW
+om7j+sjH+r25juNrAkT0FeDna0nNS27pTqlE8KSAn+xOt01IMBC3JZYvJyf/8Mpe
+CJgrnTDUjeRF4cDJEOHTgZVP9NRy9h5YFz6FCJXbEIJxfS8YifnubIIKaJv/KikS
+LoDTmb5w3hf8laD0dkBSWxD2DI/sMs+Ck+aQcU9W+9aJpAzsO5N8+1O9l6UsYlOG
+68xBdWRbLGdN3uWy2BNanpmIMbYp6SFFzeXveELNIxgseVAV8EjndbtfQ6kGYJYP
+i5aRVQmuHCCNgxDMjqi0unh6k5baavq/kTqklA6qjdbXRF5Uwzs+qc/+UAm6TuO1
+TsjoINNMwYx+PYF2Y/6poZSMYjH7PkxON1ZYABvWXGcL+oWj8k+w+hc8EbnKup2w
+sm9T+6nrQWvjeib6omHdpBj8Fu+Q2/LbEb/ZDIFiGgffKaJZwnido+GXMyPzZpCY
+m2YS72WlOd0Sn5m28Bz1DNrLkIBUeyfEtEnoqw7XpxWWV58KZGZFP1vlMu4qeNMV
+lpS+IhgUFSX2HY/mr8rsAbsCAwEAAQ==
 -----END PUBLIC KEY-----