CSHARP-5626 Add evergreen script to generate CycloneDX SBOM #1718

jasonhills-mongodb · 2025-07-01T15:43:56Z

Added a bash script to generate a build lifecycle CycloneDX SBOM using the cyclonedx-dotnet tool. The script installs a fixed version of cyclonedx-dotnet, runs a versioned dotnet restore, and generates an SBOM for each of the 4 MongoDB.Driver Nuget packages.

To ensure accurate results, two queries are run against each of the .csproj files to ensure all development packages are excluded and that any local <ProjectReference> items are marked in the SBOM as Nuget packages. Once all 4 SBOMs are created, they are merged into a single hierarchical SBOM file.

The file is saved as sbom.cdx.json (as opposed to the current sbom.json) which is the preferred file extension for CycloneDX files. There is not yet any code to commit the new SBOM to the repo. This is to allow for evaluation of the new SBOM first without interfering with the current workflow to upload the current static sbom.json file to Kondukto.

There is also a line added to download-augmented-sbom.sh to copy the augmented SBOM to vex.cdx.json (also not yet committed to repo) after it has been uploaded to the release artifacts bucket, as this is how we should be storing the augmented SBOM for public consumption.

Once the SBOM generation process has been approved, I will add commit code for both of the cdx.json files, remove the sbom.json file and update download-augmented-sbom.sh to use the new sbom.cdx.json file.

Added a bash script to generate a 'build' lifecycle CycloneDX SBOM using the cyclonedx-dotnet tool. The script installed a fixed version of cyclonedx-dotnet, runs a versioned dotnet restore, and generates an SBOM for each of the 4 MongoDB.Driver Nuget packages. To ensure accurate results, two queries are run against each of the .csproj files to ensure all development packages are excluded and that any local <ProjectReference> items are marked in the SBOM as Nuget packages. Once all 4 SBOMs are created, they are merged into a single heirarchical SBOM file. The file is saved as sbom.cdx.json (as opposed to the current sbom.json) which is the preferred file extention for CycloneDX files. There is not yet any code to commit the new SBOM to the repo. This is to allow for evaluation of the new SBOM first without intefering with the current workflow to upload the current static sbom.json file to Kondukto. There is also a line added to download-augmented-sbom.sh to copy the augmented SBOM to ./vex.cdx.json (also not yet committed to repo) after it has been uploaded to the release artifacts bucket, as this is how we should be storing the augmented SBOM for public consumption. Once the SBOM generation process has been approved, I will add commit code for both of the cdx.json files, remove th sbom.json file and update download-augmented-sbom.sh to use the new sbom.cdx.json file.

Undoing unintended changes to evergreen.yml

jasonhills-mongodb · 2025-07-01T21:05:09Z

To generate the SBOM, run evergreen/generate-sbom.sh. There shouldn't be any pre-requisites other than having the basic dotnet toolchain(s) available.

…clonedx-dotnet

adelinowona · 2025-11-18T00:25:57Z

evergreen/generate-sbom.sh

+  # Patch JSON file with PURLs, as needed
+  for patch in $PURL_PATCHES; do
+    echo "Patching ${patch} with Nuget PURL"
+    contents=$(jq --arg package "$patch" --arg version "$PACKAGE_VERSION" '.components |= map(if [.name | startswith("MongoDB.")] and has("purl") == false then .purl = "pkg:nuget/\($package)@\($version)" else . end)' ${SBOM_FILE})


Question: If a package has multiple ProjectReferences (e.g., MongoDB.Driver references both MongoDB.Bson and MongoDB.Driver.Core), won't this logic:

Loop 1: Match ALL components starting with "MongoDB." that lack PURLs, assign all of them pkg:nuget/MongoDB.Bson@VERSION

Loop 2: All MongoDB components now have PURLs, so nothing gets patched with MongoDB.Driver.Core

Should the condition be .name == $package instead of .name | startswith("MongoDB.")?

adelinowona · 2025-11-18T00:27:39Z

evergreen/generate-sbom.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -o errexit # Exit the script with error if any of the commands fail
+


Suggested change

# Environment Variables:

# PACKAGE_VERSION (optional) - Version to use for SBOM generation

# Defaults to output of get-version.sh

# GITHUB_USER (optional) - GitHub username for license resolution

# GITHUB_APIKEY (optional) - GitHub API token for license resolution

Add a comment block to describe variables used in the script.

adelinowona · 2025-11-18T00:30:54Z

evergreen/download-augmented-sbom.sh

-  augment --repo mongodb/mongo-csharp-driver --branch main --sbom-in /pwd/sbom.json --sbom-out /pwd/${SSDLC_PATH}/augmented-sbom.json
+  augment --repo mongodb/mongo-csharp-driver --branch main --sbom-in /pwd/sbom.json --sbom-out /pwd/${SSDLC_PATH}/augmented-sbom.json
+
+cp /pwd/${SSDLC_PATH}/augmented-sbom.json ./vex.cdx.json


I don't think /pwd/ is available in this context since we are outside the docker command. I think it should be ${PWD}

adelinowona · 2025-11-18T00:32:25Z

evergreen/generate-sbom.sh

+  ## Run cyclonedx-dotnet
+  # Attempt GitHub license resolution only if GITHUB_USER and GITHUB_APIKEY are both set
+  if [[ -v GITHUB_USER && -v GITHUB_APIKEY ]]; then
+    github_options=(--enable-github-licenses --github-username ${GITHUB_USER} --github-token ${GITHUB_APIKEY})


Maybe add some echo messages to indicate whether github license resolution is enabled or not

adelinowona · 2025-11-18T00:37:03Z

evergreen/generate-sbom.sh

+
+# Use cyclonedx-cli to merge the SBOMs into 1 hierarchical SBOM
+docker run --platform="linux/amd64" --rm -v ${PWD}:/pwd \
+  cyclonedx/cyclonedx-cli:0.28.2 \


Not sure if we should be using latest here or not. But if we use a specific version as now, should we include the digest as well for security?

adelinowona · 2025-11-18T00:58:49Z

evergreen/generate-sbom.sh

+  # There are nuances to how cyclonedx-dotnet handles <PackageReference> items in Directory.Build.props that lead to private packages being included in SBOM
+  # results even when PrivateAssets is set to "All". As a safeguard, this command lists the PackageReferences and adds the references with PrivateAssets="All"
+  # to an exclusion filter variable to be fed into cyclonedx-dotnet
+  EXCLUDE_FILTER=$(dotnet msbuild ./src/${package}/${package}.csproj -getItem:PackageReference | jq -r '[.Items.PackageReference[] | select(.PrivateAssets != null) | select(.PrivateAssets | test ("All"; "i")) | .Identity + "@" + .Version] | join(",")')


So the option --exclude-dev doesn't help with this?

jasonhills-mongodb added 2 commits July 1, 2025 11:40

Revert changes made to evergreen.yml

44d1370

Undoing unintended changes to evergreen.yml

jasonhills-mongodb marked this pull request as ready for review July 1, 2025 15:50

jasonhills-mongodb requested a review from a team as a code owner July 1, 2025 15:50

jasonhills-mongodb requested review from papafe and removed request for a team July 1, 2025 15:50

papafe removed their request for review July 3, 2025 16:16

adelinowona self-requested a review July 3, 2025 17:07

sanych-sun added the chore Non–user-facing code changes (tests, build scripts, etc.). label Jul 31, 2025

jasonhills-mongodb changed the title ~~CSHARP-5626: Add evergreen script to generate CycloneDX SBOM~~ CSHARP-5626 Add evergreen script to generate CycloneDX SBOM Aug 6, 2025

Merge branch 'mongodb:main' into CSHARP-5626/sbom_generation_using_cy…

c5e87f9

…clonedx-dotnet

adelinowona requested changes Nov 18, 2025

View reviewed changes

adelinowona reviewed Nov 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CSHARP-5626 Add evergreen script to generate CycloneDX SBOM #1718

CSHARP-5626 Add evergreen script to generate CycloneDX SBOM #1718

Uh oh!

jasonhills-mongodb commented Jul 1, 2025

Uh oh!

jasonhills-mongodb commented Jul 1, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

adelinowona Nov 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,87 @@
		#!/usr/bin/env bash
		set -o errexit # Exit the script with error if any of the commands fail

+# Environment Variables:
+  #   PACKAGE_VERSION (optional) - Version to use for SBOM generation
+  #                                Defaults to output of get-version.sh
+  #   GITHUB_USER (optional)     - GitHub username for license resolution
+  #   GITHUB_APIKEY (optional)   - GitHub API token for license resolution

CSHARP-5626 Add evergreen script to generate CycloneDX SBOM #1718

Are you sure you want to change the base?

CSHARP-5626 Add evergreen script to generate CycloneDX SBOM #1718

Uh oh!

Conversation

jasonhills-mongodb commented Jul 1, 2025

Uh oh!

jasonhills-mongodb commented Jul 1, 2025

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

adelinowona Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants